From b9287208523e1a5c05939fe0db038df51a9082fc Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Wed, 30 Aug 2017 16:57:50 +0200
Subject: Support discussion locking in the backend

---
 app/controllers/projects/issues_controller.rb      |  1 +
 .../merge_requests/application_controller.rb       |  1 +
 app/controllers/projects/notes_controller.rb       | 14 ++++++
 app/helpers/notes_helper.rb                        |  4 ++
 app/models/system_note_metadata.rb                 |  2 +-
 app/policies/issuable_policy.rb                    |  5 ++
 app/policies/note_policy.rb                        | 10 ++++
 app/services/issuable_base_service.rb              |  1 +
 app/services/issues/update_service.rb              |  8 ++++
 app/services/system_note_service.rb                | 12 +++++
 ...61207221154_add_dicussion_locked_to_issuable.rb | 16 +++++++
 db/schema.rb                                       |  2 +
 spec/controllers/projects/notes_controller_spec.rb | 41 ++++++++++++++++
 .../gitlab/import_export/safe_model_attributes.yml |  2 +
 spec/policies/issuable_policy_spec.rb              | 28 +++++++++++
 spec/policies/note_policy_spec.rb                  | 54 ++++++++++++++++++++++
 spec/services/issues/update_service_spec.rb        |  5 +-
 .../services/merge_requests/update_service_spec.rb |  4 +-
 18 files changed, 207 insertions(+), 3 deletions(-)
 create mode 100644 db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
 create mode 100644 spec/policies/issuable_policy_spec.rb
 create mode 100644 spec/policies/note_policy_spec.rb

diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb
index 8990c919ca0..ab75a68e56a 100644
--- a/app/controllers/projects/issues_controller.rb
+++ b/app/controllers/projects/issues_controller.rb
@@ -289,6 +289,7 @@ class Projects::IssuesController < Projects::ApplicationController
       state_event
       task_num
       lock_version
+      discussion_locked
     ] + [{ label_ids: [], assignee_ids: [] }]
   end
 
diff --git a/app/controllers/projects/merge_requests/application_controller.rb b/app/controllers/projects/merge_requests/application_controller.rb
index 6602b204fcb..eb7d7bf374c 100644
--- a/app/controllers/projects/merge_requests/application_controller.rb
+++ b/app/controllers/projects/merge_requests/application_controller.rb
@@ -34,6 +34,7 @@ class Projects::MergeRequests::ApplicationController < Projects::ApplicationCont
       :target_project_id,
       :task_num,
       :title,
+      :discussion_locked,
 
       label_ids: []
     ]
diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index 41a13f6f577..dd3dc71c004 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -66,7 +66,21 @@ class Projects::NotesController < Projects::ApplicationController
     params.merge(last_fetched_at: last_fetched_at)
   end
 
+  def authorize_admin_note!
+    return access_denied! unless can?(current_user, :admin_note, note)
+  end
+
   def authorize_resolve_note!
     return access_denied! unless can?(current_user, :resolve_note, note)
   end
+
+  def authorize_create_note!
+    noteable_type = note_params[:noteable_type]
+
+    return unless ['MergeRequest', 'Issue'].include?(noteable_type)
+    return access_denied! unless can?(current_user, :create_note, project)
+
+    noteable = noteable_type.constantize.find(note_params[:noteable_id])
+    access_denied! unless can?(current_user, :create_note, noteable)
+  end
 end
diff --git a/app/helpers/notes_helper.rb b/app/helpers/notes_helper.rb
index ce028195e51..c219aa3d6a9 100644
--- a/app/helpers/notes_helper.rb
+++ b/app/helpers/notes_helper.rb
@@ -130,8 +130,12 @@ module NotesHelper
   end
 
   def can_create_note?
+    issuable = @issue || @merge_request
+
     if @snippet.is_a?(PersonalSnippet)
       can?(current_user, :comment_personal_snippet, @snippet)
+    elsif issuable
+      can?(current_user, :create_note, issuable)
     else
       can?(current_user, :create_note, @project)
     end
diff --git a/app/models/system_note_metadata.rb b/app/models/system_note_metadata.rb
index 0b33e45473b..1f9f8d7286b 100644
--- a/app/models/system_note_metadata.rb
+++ b/app/models/system_note_metadata.rb
@@ -2,7 +2,7 @@ class SystemNoteMetadata < ActiveRecord::Base
   ICON_TYPES = %w[
     commit description merge confidential visible label assignee cross_reference
     title time_tracking branch milestone discussion task moved
-    opened closed merged duplicate
+    opened closed merged duplicate locked unlocked
     outdated
   ].freeze
 
diff --git a/app/policies/issuable_policy.rb b/app/policies/issuable_policy.rb
index daf6fa9e18a..212f4989557 100644
--- a/app/policies/issuable_policy.rb
+++ b/app/policies/issuable_policy.rb
@@ -1,6 +1,9 @@
 class IssuablePolicy < BasePolicy
   delegate { @subject.project }
 
+  condition(:locked) { @subject.discussion_locked? }
+  condition(:is_project_member) { @user && @subject.project && @subject.project.team.member?(@user) }
+
   desc "User is the assignee or author"
   condition(:assignee_or_author) do
     @user && @subject.assignee_or_author?(@user)
@@ -12,4 +15,6 @@ class IssuablePolicy < BasePolicy
     enable :read_merge_request
     enable :update_merge_request
   end
+
+  rule { locked & ~is_project_member }.prevent :create_note
 end
diff --git a/app/policies/note_policy.rb b/app/policies/note_policy.rb
index 20cd51cfb99..5d51fbf4f4a 100644
--- a/app/policies/note_policy.rb
+++ b/app/policies/note_policy.rb
@@ -2,14 +2,18 @@ class NotePolicy < BasePolicy
   delegate { @subject.project }
 
   condition(:is_author) { @user && @subject.author == @user }
+  condition(:is_project_member) { @user && @subject.project && @subject.project.team.member?(@user) }
   condition(:for_merge_request, scope: :subject) { @subject.for_merge_request? }
   condition(:is_noteable_author) { @user && @subject.noteable.author_id == @user.id }
 
   condition(:editable, scope: :subject) { @subject.editable? }
+  condition(:locked) { @subject.noteable.discussion_locked? }
 
   rule { ~editable | anonymous }.prevent :edit_note
+
   rule { is_author | admin }.enable :edit_note
   rule { can?(:master_access) }.enable :edit_note
+  rule { locked & ~is_author & ~is_project_member }.prevent :edit_note
 
   rule { is_author }.policy do
     enable :read_note
@@ -21,4 +25,10 @@ class NotePolicy < BasePolicy
   rule { for_merge_request & is_noteable_author }.policy do
     enable :resolve_note
   end
+
+  rule { locked & ~is_project_member }.policy do
+    prevent :update_note
+    prevent :admin_note
+    prevent :resolve_note
+  end
 end
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index 8b967b78052..40793201664 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -57,6 +57,7 @@ class IssuableBaseService < BaseService
       params.delete(:due_date)
       params.delete(:canonical_issue_id)
       params.delete(:project)
+      params.delete(:discussion_locked)
     end
 
     filter_assignee(issuable)
diff --git a/app/services/issues/update_service.rb b/app/services/issues/update_service.rb
index b4ca3966505..2a24ee85c45 100644
--- a/app/services/issues/update_service.rb
+++ b/app/services/issues/update_service.rb
@@ -41,6 +41,10 @@ module Issues
         create_confidentiality_note(issue)
       end
 
+      if issue.previous_changes.include?('discussion_locked')
+        create_discussion_lock_note(issue)
+      end
+
       added_labels = issue.labels - old_labels
 
       if added_labels.present?
@@ -95,5 +99,9 @@ module Issues
     def create_confidentiality_note(issue)
       SystemNoteService.change_issue_confidentiality(issue, issue.project, current_user)
     end
+
+    def create_discussion_lock_note(issue)
+      SystemNoteService.discussion_lock(issue, current_user)
+    end
   end
 end
diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb
index 1f66a2668f9..cec0a1b6efa 100644
--- a/app/services/system_note_service.rb
+++ b/app/services/system_note_service.rb
@@ -591,6 +591,18 @@ module SystemNoteService
     create_note(NoteSummary.new(noteable, project, author, body, action: 'duplicate'))
   end
 
+  def discussion_lock(issuable, author)
+    if issuable.discussion_locked
+      body = 'locked this issue'
+      action = 'locked'
+    else
+      body = 'unlocked this issue'
+      action = 'unlocked'
+    end
+
+    create_note(NoteSummary.new(issuable, issuable.project, author, body, action: action))
+  end
+
   private
 
   def notes_for_mentioner(mentioner, noteable, notes)
diff --git a/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb b/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
new file mode 100644
index 00000000000..bb60ac2a410
--- /dev/null
+++ b/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
@@ -0,0 +1,16 @@
+class AddDicussionLockedToIssuable < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+  disable_ddl_transaction!
+
+  def up
+    add_column(:merge_requests, :discussion_locked, :boolean)
+    add_column(:issues, :discussion_locked, :boolean)
+  end
+
+  def down
+    remove_column(:merge_requests, :discussion_locked)
+    remove_column(:issues, :discussion_locked)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 2149f5ad23d..16f38f7b60b 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -660,6 +660,7 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.integer "cached_markdown_version"
     t.datetime "last_edited_at"
     t.integer "last_edited_by_id"
+    t.boolean "discussion_locked", default: false, null: false
   end
 
   add_index "issues", ["assignee_id"], name: "index_issues_on_assignee_id", using: :btree
@@ -882,6 +883,7 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.integer "head_pipeline_id"
     t.boolean "ref_fetched"
     t.string "merge_jid"
+    t.boolean "discussion_locked", default: false, null: false
   end
 
   add_index "merge_requests", ["assignee_id"], name: "index_merge_requests_on_assignee_id", using: :btree
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 6ffe41b8608..26429b57bd5 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -232,6 +232,47 @@ describe Projects::NotesController do
         end
       end
     end
+
+    context 'when the merge request discussion is locked' do
+      before do
+        project.update_attribute(:visibility_level, Gitlab::VisibilityLevel::PUBLIC)
+        merge_request.update_attribute(:discussion_locked, true)
+      end
+
+      context 'when a user is a team member' do
+        it 'returns 302 status for html' do
+          post :create, request_params
+
+          expect(response).to have_http_status(302)
+        end
+
+        it 'returns 200 status for json' do
+          post :create, request_params.merge(format: :json)
+
+          expect(response).to have_http_status(200)
+        end
+
+        it 'creates a new note' do
+          expect{ post :create, request_params }.to change { Note.count }.by(1)
+        end
+      end
+
+      context 'when a user is not a team member' do
+        before do
+          project.project_member(user).destroy
+        end
+
+        it 'returns 404 status' do
+          post :create, request_params
+
+          expect(response).to have_http_status(404)
+        end
+
+        it 'does not create a new note' do
+          expect{ post :create, request_params }.not_to change { Note.count }
+        end
+      end
+    end
   end
 
   describe 'DELETE destroy' do
diff --git a/spec/lib/gitlab/import_export/safe_model_attributes.yml b/spec/lib/gitlab/import_export/safe_model_attributes.yml
index 899d17d97c2..763ab029051 100644
--- a/spec/lib/gitlab/import_export/safe_model_attributes.yml
+++ b/spec/lib/gitlab/import_export/safe_model_attributes.yml
@@ -25,6 +25,7 @@ Issue:
 - relative_position
 - last_edited_at
 - last_edited_by_id
+- discussion_locked
 Event:
 - id
 - target_type
@@ -168,6 +169,7 @@ MergeRequest:
 - last_edited_at
 - last_edited_by_id
 - head_pipeline_id
+- discussion_locked
 MergeRequestDiff:
 - id
 - state
diff --git a/spec/policies/issuable_policy_spec.rb b/spec/policies/issuable_policy_spec.rb
new file mode 100644
index 00000000000..9b399d764ea
--- /dev/null
+++ b/spec/policies/issuable_policy_spec.rb
@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe IssuablePolicy, models: true do
+  describe '#rules' do
+    context 'when discussion is locked for the issuable' do
+      let(:user) { create(:user) }
+      let(:project) { create(:project, :public) }
+      let(:issue) { create(:issue, project: project, discussion_locked: true) }
+      let(:policies) { described_class.new(user, issue) }
+
+      context 'when the user is not a project member' do
+        it 'can not create a note' do
+          expect(policies).to be_disallowed(:create_note)
+        end
+      end
+
+      context 'when the user is a project member' do
+        before do
+          project.team << [user, :guest]
+        end
+
+        it 'can create a note' do
+          expect(policies).to be_allowed(:create_note)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/policies/note_policy_spec.rb b/spec/policies/note_policy_spec.rb
new file mode 100644
index 00000000000..70a99ed0198
--- /dev/null
+++ b/spec/policies/note_policy_spec.rb
@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe NotePolicy, mdoels: true do
+  describe '#rules' do
+    let(:user) { create(:user) }
+    let(:project) { create(:project, :public) }
+    let(:issue) { create(:issue, project: project) }
+    let(:note) { create(:note, noteable: issue, author: user, project: project) }
+
+    let(:policies) { described_class.new(user, note) }
+
+    context 'when the project is public' do
+      context 'when the note author is not a project member' do
+        it 'can edit a note' do
+          expect(policies).to be_allowed(:update_note)
+          expect(policies).to be_allowed(:admin_note)
+          expect(policies).to be_allowed(:resolve_note)
+          expect(policies).to be_allowed(:read_note)
+        end
+      end
+
+      context 'when a discussion is locked' do
+        before do
+          issue.update_attribute(:discussion_locked, true)
+        end
+
+        context 'when the note author is a project member' do
+          before do
+            project.add_developer(user)
+          end
+
+          it 'can eddit a note' do
+            expect(policies).to be_allowed(:update_note)
+            expect(policies).to be_allowed(:admin_note)
+            expect(policies).to be_allowed(:resolve_note)
+            expect(policies).to be_allowed(:read_note)
+          end
+        end
+
+        context 'when the note author is not a project member' do
+          it 'can not edit a note' do
+            expect(policies).to be_disallowed(:update_note)
+            expect(policies).to be_disallowed(:admin_note)
+            expect(policies).to be_disallowed(:resolve_note)
+          end
+
+          it 'can read a note' do
+            expect(policies).to be_allowed(:read_note)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/issues/update_service_spec.rb b/spec/services/issues/update_service_spec.rb
index 15a50b85f19..0ed4c2152bb 100644
--- a/spec/services/issues/update_service_spec.rb
+++ b/spec/services/issues/update_service_spec.rb
@@ -48,7 +48,8 @@ describe Issues::UpdateService, :mailer do
           assignee_ids: [user2.id],
           state_event: 'close',
           label_ids: [label.id],
-          due_date: Date.tomorrow
+          due_date: Date.tomorrow,
+          discussion_locked: true
         }
       end
 
@@ -62,6 +63,7 @@ describe Issues::UpdateService, :mailer do
         expect(issue).to be_closed
         expect(issue.labels).to match_array [label]
         expect(issue.due_date).to eq Date.tomorrow
+        expect(issue.discussion_locked).to be_truthy
       end
 
       it 'updates open issue counter for assignees when issue is reassigned' do
@@ -103,6 +105,7 @@ describe Issues::UpdateService, :mailer do
           expect(issue.labels).to be_empty
           expect(issue.milestone).to be_nil
           expect(issue.due_date).to be_nil
+          expect(issue.discussion_locked).to be_falsey
         end
       end
 
diff --git a/spec/services/merge_requests/update_service_spec.rb b/spec/services/merge_requests/update_service_spec.rb
index 681feee61d1..a07b7ac2218 100644
--- a/spec/services/merge_requests/update_service_spec.rb
+++ b/spec/services/merge_requests/update_service_spec.rb
@@ -49,7 +49,8 @@ describe MergeRequests::UpdateService, :mailer do
           state_event: 'close',
           label_ids: [label.id],
           target_branch: 'target',
-          force_remove_source_branch: '1'
+          force_remove_source_branch: '1',
+          discussion_locked: true
         }
       end
 
@@ -73,6 +74,7 @@ describe MergeRequests::UpdateService, :mailer do
         expect(@merge_request.labels.first.title).to eq(label.name)
         expect(@merge_request.target_branch).to eq('target')
         expect(@merge_request.merge_params['force_remove_source_branch']).to eq('1')
+        expect(@merge_request.discussion_locked).to be_truthy
       end
 
       it 'executes hooks with update action' do
-- 
cgit v1.2.1


From 073ba05d315881730de3995042cc4256c116e2c4 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 31 Aug 2017 12:38:32 +0200
Subject: Support discussion lock in the API

---
 doc/api/issues.md                                  | 57 ++++++++++++++++++++--
 doc/api/merge_requests.md                          | 11 ++++-
 lib/api/entities.rb                                |  2 +
 lib/api/issues.rb                                  |  3 +-
 lib/api/merge_requests.rb                          |  4 +-
 lib/api/notes.rb                                   |  7 +++
 .../fixtures/api/schemas/public_api/v4/issues.json |  1 +
 .../api/schemas/public_api/v4/merge_requests.json  |  1 +
 8 files changed, 79 insertions(+), 7 deletions(-)

diff --git a/doc/api/issues.md b/doc/api/issues.md
index 8ca66049d31..61e42345153 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -109,7 +109,8 @@ Example response:
          "human_time_estimate": null,
          "human_total_time_spent": null
       },
-      "confidential": false
+      "confidential": false,
+      "discussion_locked": false
    }
 ]
 ```
@@ -214,7 +215,8 @@ Example response:
          "human_time_estimate": null,
          "human_total_time_spent": null
       },
-      "confidential": false
+      "confidential": false,
+      "discussion_locked": false
    }
 ]
 ```
@@ -320,7 +322,8 @@ Example response:
          "human_time_estimate": null,
          "human_total_time_spent": null
       },
-      "confidential": false
+      "confidential": false,
+      "discussion_locked": false
    }
 ]
 ```
@@ -403,6 +406,7 @@ Example response:
       "human_total_time_spent": null
    },
    "confidential": false,
+   "discussion_locked": false,
    "_links": {
       "self": "http://example.com/api/v4/projects/1/issues/2",
       "notes": "http://example.com/api/v4/projects/1/issues/2/notes",
@@ -477,6 +481,7 @@ Example response:
       "human_total_time_spent": null
    },
    "confidential": false,
+   "discussion_locked": false,
    "_links": {
       "self": "http://example.com/api/v4/projects/1/issues/2",
       "notes": "http://example.com/api/v4/projects/1/issues/2/notes",
@@ -510,6 +515,8 @@ PUT /projects/:id/issues/:issue_iid
 | `state_event`  | string  | no       | The state event of an issue. Set `close` to close the issue and `reopen` to reopen it                      |
 | `updated_at`   | string  | no       | Date time string, ISO 8601 formatted, e.g. `2016-03-11T03:45:40Z` (requires admin or project owner rights) |
 | `due_date`     | string  | no       | Date time string in the format YEAR-MONTH-DAY, e.g. `2016-03-11`                                           |
+| `discussion_locked` | boolean | no  | Updates an issue to lock or unlock its discussion |
+
 
 ```bash
 curl --request PUT --header "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" https://gitlab.example.com/api/v4/projects/4/issues/85?state_event=close
@@ -552,6 +559,7 @@ Example response:
       "human_total_time_spent": null
    },
    "confidential": false,
+   "discussion_locked": false,
    "_links": {
       "self": "http://example.com/api/v4/projects/1/issues/2",
       "notes": "http://example.com/api/v4/projects/1/issues/2/notes",
@@ -650,6 +658,7 @@ Example response:
     "human_total_time_spent": null
   },
   "confidential": false,
+  "discussion_locked": false,
   "_links": {
     "self": "http://example.com/api/v4/projects/1/issues/2",
     "notes": "http://example.com/api/v4/projects/1/issues/2/notes",
@@ -727,6 +736,7 @@ Example response:
     "human_total_time_spent": null
   },
   "confidential": false,
+  "discussion_locked": false,
   "_links": {
     "self": "http://example.com/api/v4/projects/1/issues/2",
     "notes": "http://example.com/api/v4/projects/1/issues/2/notes",
@@ -757,6 +767,44 @@ POST /projects/:id/issues/:issue_iid/unsubscribe
 curl --request POST --header "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" https://gitlab.example.com/api/v4/projects/5/issues/93/unsubscribe
 ```
 
+Example response:
+
+```json
+{
+  "id": 93,
+  "iid": 12,
+  "project_id": 5,
+  "title": "Incidunt et rerum ea expedita iure quibusdam.",
+  "description": "Et cumque architecto sed aut ipsam.",
+  "state": "opened",
+  "created_at": "2016-04-05T21:41:45.217Z",
+  "updated_at": "2016-04-07T13:02:37.905Z",
+  "labels": [],
+  "milestone": null,
+  "assignee": {
+    "name": "Edwardo Grady",
+    "username": "keyon",
+    "id": 21,
+    "state": "active",
+    "avatar_url": "http://www.gravatar.com/avatar/3e6f06a86cf27fa8b56f3f74f7615987?s=80&d=identicon",
+    "web_url": "https://gitlab.example.com/keyon"
+  },
+  "author": {
+    "name": "Vivian Hermann",
+    "username": "orville",
+    "id": 11,
+    "state": "active",
+    "avatar_url": "http://www.gravatar.com/avatar/5224fd70153710e92fb8bcf79ac29d67?s=80&d=identicon",
+    "web_url": "https://gitlab.example.com/orville"
+  },
+  "subscribed": false,
+  "due_date": null,
+  "web_url": "http://example.com/example/example/issues/12",
+  "confidential": false,
+  "discussion_locked": false
+}
+```
+
 ## Create a todo
 
 Manually creates a todo for the current user on an issue. If
@@ -849,7 +897,8 @@ Example response:
     "downvotes": 0,
     "due_date": null,
     "web_url": "http://example.com/example/example/issues/110",
-    "confidential": false
+    "confidential": false,
+    "discussion_locked": false
   },
   "target_url": "https://gitlab.example.com/gitlab-org/gitlab-ci/issues/10",
   "body": "Vel voluptas atque dicta mollitia adipisci qui at.",
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index bff8a2d3e4d..e5d1ebb9cfb 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -192,6 +192,7 @@ Parameters:
     "should_remove_source_branch": true,
     "force_remove_source_branch": false,
     "web_url": "http://example.com/example/example/merge_requests/1",
+    "discussion_locked": false,
     "time_stats": {
       "time_estimate": 0,
       "total_time_spent": 0,
@@ -267,6 +268,7 @@ Parameters:
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -378,6 +380,7 @@ Parameters:
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -471,6 +474,7 @@ POST /projects/:id/merge_requests
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -500,6 +504,7 @@ PUT /projects/:id/merge_requests/:merge_request_iid
 | `labels`               | string  | no       | Labels for MR as a comma-separated list                                         |
 | `milestone_id`         | integer | no       | The ID of a milestone                                                           |
 | `remove_source_branch` | boolean | no       | Flag indicating if a merge request should remove the source branch when merging |
+| `discussion_locked` | boolean | no | Flag indicating if the merge request's discussion is locked |
 
 Must include at least one non-required attribute from above.
 
@@ -554,6 +559,7 @@ Must include at least one non-required attribute from above.
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -658,6 +664,7 @@ Parameters:
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -734,6 +741,7 @@ Parameters:
   "should_remove_source_branch": true,
   "force_remove_source_branch": false,
   "web_url": "http://example.com/example/example/merge_requests/1",
+  "discussion_locked": false,
   "time_stats": {
     "time_estimate": 0,
     "total_time_spent": 0,
@@ -1028,7 +1036,8 @@ Example response:
       "id": 14,
       "state": "active",
       "avatar_url": "http://www.gravatar.com/avatar/a7fa515d53450023c83d62986d0658a8?s=80&d=identicon",
-      "web_url": "https://gitlab.example.com/francisca"
+      "web_url": "https://gitlab.example.com/francisca",
+      "discussion_locked": false
     },
     "assignee": {
       "name": "Dr. Gabrielle Strosin",
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 52c49e5caa9..4b2ac1cce95 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -362,6 +362,7 @@ module API
       end
       expose :due_date
       expose :confidential
+      expose :discussion_locked
 
       expose :web_url do |issue, options|
         Gitlab::UrlBuilder.build(issue)
@@ -458,6 +459,7 @@ module API
       expose :diff_head_sha, as: :sha
       expose :merge_commit_sha
       expose :user_notes_count
+      expose :discussion_locked
       expose :should_remove_source_branch?, as: :should_remove_source_branch
       expose :force_remove_source_branch?, as: :force_remove_source_branch
 
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 1729df2aad0..88b592083db 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -48,6 +48,7 @@ module API
         optional :labels, type: String, desc: 'Comma-separated list of label names'
         optional :due_date, type: String, desc: 'Date string in the format YEAR-MONTH-DAY'
         optional :confidential, type: Boolean, desc: 'Boolean parameter if the issue should be confidential'
+        optional :discussion_locked, type: Boolean, desc: "Boolean parameter if the issue's discussion should be locked"
       end
 
       params :issue_params do
@@ -193,7 +194,7 @@ module API
                               desc: 'Date time when the issue was updated. Available only for admins and project owners.'
         optional :state_event, type: String, values: %w[reopen close], desc: 'State of the issue'
         use :issue_params
-        at_least_one_of :title, :description, :assignee_ids, :assignee_id, :milestone_id,
+        at_least_one_of :title, :description, :assignee_ids, :assignee_id, :milestone_id, :discussion_locked,
                         :labels, :created_at, :due_date, :confidential, :state_event
       end
       put ':id/issues/:issue_iid' do
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 56d72d511da..35395647fac 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -213,12 +213,14 @@ module API
           :remove_source_branch,
           :state_event,
           :target_branch,
-          :title
+          :title,
+          :discussion_locked
         ]
         optional :title, type: String, allow_blank: false, desc: 'The title of the merge request'
         optional :target_branch, type: String, allow_blank: false, desc: 'The target branch'
         optional :state_event, type: String, values: %w[close reopen],
                                desc: 'Status of the merge request'
+        optional :discussion_locked, type: Boolean, desc: 'Whether the MR discussion is locked'
 
         use :optional_params
         at_least_one_of(*at_least_one_of_ce)
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index d6e7203adaf..b3db366d875 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -71,6 +71,8 @@ module API
         post ":id/#{noteables_str}/:noteable_id/notes" do
           noteable = find_project_noteable(noteables_str, params[:noteable_id])
 
+          authorize! :create_note, user_project
+
           opts = {
             note: params[:body],
             noteable_type: noteables_str.classify,
@@ -82,6 +84,11 @@ module API
               opts[:created_at] = params[:created_at]
             end
 
+            noteable_type = opts[:noteable_type].to_s
+            noteable = Issue.find(opts[:noteable_id]) if noteable_type == 'Issue'
+            noteable = MergeRequest.find(opts[:noteable_id]) if noteable_type == 'MergeRequest'
+            authorize! :create_note, noteable if noteable
+
             note = ::Notes::CreateService.new(user_project, current_user, opts).execute
 
             if note.valid?
diff --git a/spec/fixtures/api/schemas/public_api/v4/issues.json b/spec/fixtures/api/schemas/public_api/v4/issues.json
index 8acd9488215..8c854a43fc6 100644
--- a/spec/fixtures/api/schemas/public_api/v4/issues.json
+++ b/spec/fixtures/api/schemas/public_api/v4/issues.json
@@ -9,6 +9,7 @@
       "title": { "type": "string" },
       "description": { "type": ["string", "null"] },
       "state": { "type": "string" },
+      "discussion_locked": { "type": "boolean" },
       "created_at": { "type": "date" },
       "updated_at": { "type": "date" },
       "labels": {
diff --git a/spec/fixtures/api/schemas/public_api/v4/merge_requests.json b/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
index 31b3f4ba946..3b42333bb10 100644
--- a/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
+++ b/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
@@ -72,6 +72,7 @@
       "user_notes_count": { "type": "integer" },
       "should_remove_source_branch": { "type": ["boolean", "null"] },
       "force_remove_source_branch": { "type": ["boolean", "null"] },
+      "discussion_locked": { "type": "boolean" },
       "web_url": { "type": "uri" },
       "time_stats": {
         "time_estimate": { "type": "integer" },
-- 
cgit v1.2.1


From 3d2917bf2e4799a7ba9bcb518c39605eca0a4b1d Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 31 Aug 2017 12:38:43 +0200
Subject: Add the possibility to lock issuables from the frontend

---
 app/assets/javascripts/discussion_lock.js         | 46 +++++++++++++++++++++++
 app/assets/javascripts/init_issuable_sidebar.js   |  1 +
 app/assets/javascripts/main.js                    |  1 +
 app/assets/stylesheets/pages/notes.scss           |  6 +++
 app/views/shared/issuable/_sidebar.html.haml      | 11 ++++++
 app/views/shared/notes/_notes_with_form.html.haml | 10 ++++-
 6 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 app/assets/javascripts/discussion_lock.js

diff --git a/app/assets/javascripts/discussion_lock.js b/app/assets/javascripts/discussion_lock.js
new file mode 100644
index 00000000000..7bf83e9b8a0
--- /dev/null
+++ b/app/assets/javascripts/discussion_lock.js
@@ -0,0 +1,46 @@
+class DiscussionLock {
+  constructor(containerElm) {
+    this.containerElm = containerElm;
+
+    const lockButton = containerElm.querySelector('.js-discussion-lock-button');
+    console.log(lockButton);
+    if (lockButton) {
+      // remove class so we don't bind twice
+      lockButton.classList.remove('js-discussion-lock-button');
+      console.log(lockButton);
+      lockButton.addEventListener('click', this.toggleDiscussionLock.bind(this));
+    }
+  }
+
+  toggleDiscussionLock(event) {
+    const button = event.currentTarget;
+    const buttonSpan = button.querySelector('span');
+    if (!buttonSpan || button.classList.contains('disabled')) {
+      return;
+    }
+    button.classList.add('disabled');
+
+    const url = this.containerElm.dataset.url;
+    const lock = this.containerElm.dataset.lock;
+    const issuableType = this.containerElm.dataset.issuableType;
+
+    const data = {}
+    data[issuableType] = {}
+    data[issuableType].discussion_locked = lock
+
+    $.ajax({
+      url,
+      data: data,
+      type: 'PUT'
+    }).done((data) => {
+      button.classList.remove('disabled');
+    });
+  }
+
+  static bindAll(selector) {
+    [].forEach.call(document.querySelectorAll(selector), elm => new DiscussionLock(elm));
+  }
+}
+
+window.gl = window.gl || {};
+window.gl.DiscussionLock = DiscussionLock;
diff --git a/app/assets/javascripts/init_issuable_sidebar.js b/app/assets/javascripts/init_issuable_sidebar.js
index 29e3d2ea94e..8857601f530 100644
--- a/app/assets/javascripts/init_issuable_sidebar.js
+++ b/app/assets/javascripts/init_issuable_sidebar.js
@@ -13,6 +13,7 @@ export default () => {
   new LabelsSelect();
   new IssuableContext(sidebarOptions.currentUser);
   gl.Subscription.bindAll('.subscription');
+  gl.DiscussionLock.bindAll('.discussion-lock');
   new gl.DueDateSelectors();
   window.sidebar = new Sidebar();
 };
diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 0bc31a56684..ea1d50de965 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -80,6 +80,7 @@ import './copy_as_gfm';
 import './copy_to_clipboard';
 import './create_label';
 import './diff';
+import './discussion_lock';
 import './dropzone_input';
 import './due_date_select';
 import './files_comment_button';
diff --git a/app/assets/stylesheets/pages/notes.scss b/app/assets/stylesheets/pages/notes.scss
index e437bad4912..94439ed94a6 100644
--- a/app/assets/stylesheets/pages/notes.scss
+++ b/app/assets/stylesheets/pages/notes.scss
@@ -703,6 +703,12 @@ ul.notes {
   color: $note-disabled-comment-color;
   padding: 90px 0;
 
+  &.discussion-locked {
+    border: none;
+    background-color: $white-light;
+  }
+
+
   a {
     color: $gl-link-color;
   }
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index 9cae3f51825..38a54c232d0 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -131,6 +131,17 @@
           %button.btn.btn-default.pull-right.js-subscribe-button.issuable-subscribe-button.hide-collapsed{ type: "button" }
             %span= subscribed ? 'Unsubscribe' : 'Subscribe'
 
+      - if can_edit_issuable
+        - locked = issuable.discussion_locked?
+        .block.light.discussion-lock{ data: { lock: (!locked).to_s, url: "#{issuable_json_path(issuable)}?basic=true", issuable_type: issuable.class.to_s.underscore } }
+          .sidebar-collapsed-icon
+            = icon('rss', 'aria-hidden': 'true')
+          %span.issuable-header-text.hide-collapsed.pull-left
+            Discussion Lock
+          - subscribtion_status = locked ? 'locked' : 'not locked'
+          %button.btn.btn-default.pull-right.js-discussion-lock-button.issuable-discussion-lock-button.hide-collapsed{ type: "button" }
+            %span= locked ? 'Unlock' : 'Lock'
+
       - project_ref = cross_project_reference(@project, issuable)
       .block.project-reference
         .sidebar-collapsed-icon.dont-change-state
diff --git a/app/views/shared/notes/_notes_with_form.html.haml b/app/views/shared/notes/_notes_with_form.html.haml
index e3e86709b8f..371a9523de9 100644
--- a/app/views/shared/notes/_notes_with_form.html.haml
+++ b/app/views/shared/notes/_notes_with_form.html.haml
@@ -1,3 +1,6 @@
+- issuable = @issue || @merge_request
+- discussion_locked = issuable&.discussion_locked?
+
 %ul#notes-list.notes.main-notes-list.timeline
   = render "shared/notes/notes"
 
@@ -21,5 +24,10 @@
     or
     = link_to "sign in", new_session_path(:user, redirect_to_referer: 'yes'), class: 'js-sign-in-link'
     to comment
-
+- elsif discussion_locked
+  .discussion_locked
+    %span
+      This
+      = issuable.class.to_s
+      has been locked. Posting comments has been restricted to project members.
 %script.js-notes-data{ type: "application/json" }= initial_notes_data(autocomplete).to_json.html_safe
-- 
cgit v1.2.1


From 2b82f907abf2074ac332531d6142893d081f44b9 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 31 Aug 2017 14:31:14 +0200
Subject: Check the discussion lock only for issuables & clean style

---
 app/controllers/projects/notes_controller.rb       | 2 +-
 app/policies/note_policy.rb                        | 2 +-
 spec/controllers/projects/notes_controller_spec.rb | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index dd3dc71c004..bb0c1869955 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -77,7 +77,7 @@ class Projects::NotesController < Projects::ApplicationController
   def authorize_create_note!
     noteable_type = note_params[:noteable_type]
 
-    return unless ['MergeRequest', 'Issue'].include?(noteable_type)
+    return unless %w[MergeRequest Issue].include?(noteable_type)
     return access_denied! unless can?(current_user, :create_note, project)
 
     noteable = noteable_type.constantize.find(note_params[:noteable_id])
diff --git a/app/policies/note_policy.rb b/app/policies/note_policy.rb
index 5d51fbf4f4a..307c514a74b 100644
--- a/app/policies/note_policy.rb
+++ b/app/policies/note_policy.rb
@@ -7,7 +7,7 @@ class NotePolicy < BasePolicy
   condition(:is_noteable_author) { @user && @subject.noteable.author_id == @user.id }
 
   condition(:editable, scope: :subject) { @subject.editable? }
-  condition(:locked) { @subject.noteable.discussion_locked? }
+  condition(:locked) { [MergeRequest, Issue].include?(@subject.noteable.class) && @subject.noteable.discussion_locked? }
 
   rule { ~editable | anonymous }.prevent :edit_note
 
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 26429b57bd5..10edad462c1 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -253,7 +253,7 @@ describe Projects::NotesController do
         end
 
         it 'creates a new note' do
-          expect{ post :create, request_params }.to change { Note.count }.by(1)
+          expect { post :create, request_params }.to change { Note.count }.by(1)
         end
       end
 
@@ -269,7 +269,7 @@ describe Projects::NotesController do
         end
 
         it 'does not create a new note' do
-          expect{ post :create, request_params }.not_to change { Note.count }
+          expect { post :create, request_params }.not_to change { Note.count }
         end
       end
     end
-- 
cgit v1.2.1


From 994e7d135947ca162c147c5e0992a0190de22808 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Fri, 1 Sep 2017 14:03:57 +0200
Subject: Create system notes for MR too, improve doc + clean up code

---
 app/controllers/projects/notes_controller.rb       |  7 +----
 app/models/concerns/noteable.rb                    |  4 +++
 app/policies/issuable_policy.rb                    | 11 +++++--
 app/policies/note_policy.rb                        | 10 +------
 app/services/issuable_base_service.rb              | 11 +++++++
 app/services/issues/update_service.rb              |  8 -----
 app/services/system_note_service.rb                |  9 ++----
 changelogs/unreleased/18608-lock-issues.yml        |  5 ++++
 ...61207221154_add_dicussion_locked_to_issuable.rb | 16 ----------
 ...0815221154_add_discussion_locked_to_issuable.rb | 13 +++++++++
 db/schema.rb                                       |  4 +--
 doc/api/issues.md                                  |  2 +-
 doc/api/merge_requests.md                          |  2 +-
 lib/api/issues.rb                                  |  2 +-
 lib/api/notes.rb                                   |  9 ++----
 spec/controllers/projects/notes_controller_spec.rb |  9 ++++++
 .../fixtures/api/schemas/public_api/v4/issues.json |  2 +-
 .../api/schemas/public_api/v4/merge_requests.json  |  2 +-
 spec/policies/issuable_policy_spec.rb              |  2 +-
 spec/policies/note_policy_spec.rb                  | 23 +++++++++++++--
 spec/requests/api/notes_spec.rb                    | 34 ++++++++++++++++++++++
 spec/services/issues/update_service_spec.rb        |  7 +++++
 .../services/merge_requests/update_service_spec.rb |  7 +++++
 23 files changed, 133 insertions(+), 66 deletions(-)
 create mode 100644 changelogs/unreleased/18608-lock-issues.yml
 delete mode 100644 db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
 create mode 100644 db/migrate/20170815221154_add_discussion_locked_to_issuable.rb

diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index bb0c1869955..ef7d047b1ad 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -75,12 +75,7 @@ class Projects::NotesController < Projects::ApplicationController
   end
 
   def authorize_create_note!
-    noteable_type = note_params[:noteable_type]
-
-    return unless %w[MergeRequest Issue].include?(noteable_type)
-    return access_denied! unless can?(current_user, :create_note, project)
-
-    noteable = noteable_type.constantize.find(note_params[:noteable_id])
+    return unless noteable.lockable?
     access_denied! unless can?(current_user, :create_note, noteable)
   end
 end
diff --git a/app/models/concerns/noteable.rb b/app/models/concerns/noteable.rb
index 1c4ddabcad5..5d75b2aa6a3 100644
--- a/app/models/concerns/noteable.rb
+++ b/app/models/concerns/noteable.rb
@@ -74,4 +74,8 @@ module Noteable
   def discussions_can_be_resolved_by?(user)
     discussions_to_be_resolved.all? { |discussion| discussion.can_resolve?(user) }
   end
+
+  def lockable?
+    [MergeRequest, Issue].include?(self.class)
+  end
 end
diff --git a/app/policies/issuable_policy.rb b/app/policies/issuable_policy.rb
index 212f4989557..f0aa16d2ecf 100644
--- a/app/policies/issuable_policy.rb
+++ b/app/policies/issuable_policy.rb
@@ -1,7 +1,8 @@
 class IssuablePolicy < BasePolicy
   delegate { @subject.project }
 
-  condition(:locked) { @subject.discussion_locked? }
+  condition(:locked, scope: :subject, score: 0) { @subject.discussion_locked? }
+
   condition(:is_project_member) { @user && @subject.project && @subject.project.team.member?(@user) }
 
   desc "User is the assignee or author"
@@ -16,5 +17,11 @@ class IssuablePolicy < BasePolicy
     enable :update_merge_request
   end
 
-  rule { locked & ~is_project_member }.prevent :create_note
+  rule { locked & ~is_project_member }.policy do
+    prevent :create_note
+    prevent :update_note
+    prevent :admin_note
+    prevent :resolve_note
+    prevent :edit_note
+  end
 end
diff --git a/app/policies/note_policy.rb b/app/policies/note_policy.rb
index 307c514a74b..d4cb5a77e63 100644
--- a/app/policies/note_policy.rb
+++ b/app/policies/note_policy.rb
@@ -1,19 +1,17 @@
 class NotePolicy < BasePolicy
   delegate { @subject.project }
+  delegate { @subject.noteable if @subject.noteable.lockable? }
 
   condition(:is_author) { @user && @subject.author == @user }
-  condition(:is_project_member) { @user && @subject.project && @subject.project.team.member?(@user) }
   condition(:for_merge_request, scope: :subject) { @subject.for_merge_request? }
   condition(:is_noteable_author) { @user && @subject.noteable.author_id == @user.id }
 
   condition(:editable, scope: :subject) { @subject.editable? }
-  condition(:locked) { [MergeRequest, Issue].include?(@subject.noteable.class) && @subject.noteable.discussion_locked? }
 
   rule { ~editable | anonymous }.prevent :edit_note
 
   rule { is_author | admin }.enable :edit_note
   rule { can?(:master_access) }.enable :edit_note
-  rule { locked & ~is_author & ~is_project_member }.prevent :edit_note
 
   rule { is_author }.policy do
     enable :read_note
@@ -25,10 +23,4 @@ class NotePolicy < BasePolicy
   rule { for_merge_request & is_noteable_author }.policy do
     enable :resolve_note
   end
-
-  rule { locked & ~is_project_member }.policy do
-    prevent :update_note
-    prevent :admin_note
-    prevent :resolve_note
-  end
 end
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index 40793201664..157539ee05b 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -43,6 +43,10 @@ class IssuableBaseService < BaseService
     SystemNoteService.change_time_spent(issuable, issuable.project, current_user)
   end
 
+  def create_discussion_lock_note(issuable)
+    SystemNoteService.discussion_lock(issuable, current_user)
+  end
+
   def filter_params(issuable)
     ability_name = :"admin_#{issuable.to_ability_name}"
 
@@ -236,6 +240,7 @@ class IssuableBaseService < BaseService
           handle_common_system_notes(issuable, old_labels: old_labels)
         end
 
+        change_discussion_lock(issuable)
         handle_changes(
           issuable,
           old_labels: old_labels,
@@ -292,6 +297,12 @@ class IssuableBaseService < BaseService
     end
   end
 
+  def change_discussion_lock(issuable)
+    if issuable.previous_changes.include?('discussion_locked')
+      create_discussion_lock_note(issuable)
+    end
+  end
+
   def toggle_award(issuable)
     award = params.delete(:emoji_award)
     if award
diff --git a/app/services/issues/update_service.rb b/app/services/issues/update_service.rb
index 2a24ee85c45..b4ca3966505 100644
--- a/app/services/issues/update_service.rb
+++ b/app/services/issues/update_service.rb
@@ -41,10 +41,6 @@ module Issues
         create_confidentiality_note(issue)
       end
 
-      if issue.previous_changes.include?('discussion_locked')
-        create_discussion_lock_note(issue)
-      end
-
       added_labels = issue.labels - old_labels
 
       if added_labels.present?
@@ -99,9 +95,5 @@ module Issues
     def create_confidentiality_note(issue)
       SystemNoteService.change_issue_confidentiality(issue, issue.project, current_user)
     end
-
-    def create_discussion_lock_note(issue)
-      SystemNoteService.discussion_lock(issue, current_user)
-    end
   end
 end
diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb
index cec0a1b6efa..7b32e215c7f 100644
--- a/app/services/system_note_service.rb
+++ b/app/services/system_note_service.rb
@@ -592,13 +592,8 @@ module SystemNoteService
   end
 
   def discussion_lock(issuable, author)
-    if issuable.discussion_locked
-      body = 'locked this issue'
-      action = 'locked'
-    else
-      body = 'unlocked this issue'
-      action = 'unlocked'
-    end
+    action = issuable.discussion_locked? ? 'locked' : 'unlocked'
+    body = "#{action} this issue"
 
     create_note(NoteSummary.new(issuable, issuable.project, author, body, action: action))
   end
diff --git a/changelogs/unreleased/18608-lock-issues.yml b/changelogs/unreleased/18608-lock-issues.yml
new file mode 100644
index 00000000000..6c0ae7cebf5
--- /dev/null
+++ b/changelogs/unreleased/18608-lock-issues.yml
@@ -0,0 +1,5 @@
+---
+title: Create system notes for MR too, improve doc + clean up code
+merge_request:
+author:
+type: added
diff --git a/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb b/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
deleted file mode 100644
index bb60ac2a410..00000000000
--- a/db/migrate/20161207221154_add_dicussion_locked_to_issuable.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-class AddDicussionLockedToIssuable < ActiveRecord::Migration
-  include Gitlab::Database::MigrationHelpers
-
-  DOWNTIME = false
-  disable_ddl_transaction!
-
-  def up
-    add_column(:merge_requests, :discussion_locked, :boolean)
-    add_column(:issues, :discussion_locked, :boolean)
-  end
-
-  def down
-    remove_column(:merge_requests, :discussion_locked)
-    remove_column(:issues, :discussion_locked)
-  end
-end
diff --git a/db/migrate/20170815221154_add_discussion_locked_to_issuable.rb b/db/migrate/20170815221154_add_discussion_locked_to_issuable.rb
new file mode 100644
index 00000000000..5bd777c53a0
--- /dev/null
+++ b/db/migrate/20170815221154_add_discussion_locked_to_issuable.rb
@@ -0,0 +1,13 @@
+class AddDiscussionLockedToIssuable < ActiveRecord::Migration
+  DOWNTIME = false
+
+  def up
+    add_column(:merge_requests, :discussion_locked, :boolean)
+    add_column(:issues, :discussion_locked, :boolean)
+  end
+
+  def down
+    remove_column(:merge_requests, :discussion_locked)
+    remove_column(:issues, :discussion_locked)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 16f38f7b60b..6cdf929b1b6 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -660,7 +660,7 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.integer "cached_markdown_version"
     t.datetime "last_edited_at"
     t.integer "last_edited_by_id"
-    t.boolean "discussion_locked", default: false, null: false
+    t.boolean "discussion_locked"
   end
 
   add_index "issues", ["assignee_id"], name: "index_issues_on_assignee_id", using: :btree
@@ -883,7 +883,7 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.integer "head_pipeline_id"
     t.boolean "ref_fetched"
     t.string "merge_jid"
-    t.boolean "discussion_locked", default: false, null: false
+    t.boolean "discussion_locked"
   end
 
   add_index "merge_requests", ["assignee_id"], name: "index_merge_requests_on_assignee_id", using: :btree
diff --git a/doc/api/issues.md b/doc/api/issues.md
index 61e42345153..479f8754bcc 100644
--- a/doc/api/issues.md
+++ b/doc/api/issues.md
@@ -515,7 +515,7 @@ PUT /projects/:id/issues/:issue_iid
 | `state_event`  | string  | no       | The state event of an issue. Set `close` to close the issue and `reopen` to reopen it                      |
 | `updated_at`   | string  | no       | Date time string, ISO 8601 formatted, e.g. `2016-03-11T03:45:40Z` (requires admin or project owner rights) |
 | `due_date`     | string  | no       | Date time string in the format YEAR-MONTH-DAY, e.g. `2016-03-11`                                           |
-| `discussion_locked` | boolean | no  | Updates an issue to lock or unlock its discussion |
+| `discussion_locked` | boolean | no  | Flag indicating if the issue's discussion is locked. If the discussion is locked only project members can add or edit comments. |
 
 
 ```bash
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index e5d1ebb9cfb..64daed7c326 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -504,7 +504,7 @@ PUT /projects/:id/merge_requests/:merge_request_iid
 | `labels`               | string  | no       | Labels for MR as a comma-separated list                                         |
 | `milestone_id`         | integer | no       | The ID of a milestone                                                           |
 | `remove_source_branch` | boolean | no       | Flag indicating if a merge request should remove the source branch when merging |
-| `discussion_locked` | boolean | no | Flag indicating if the merge request's discussion is locked |
+| `discussion_locked`    | boolean | no       | Flag indicating if the merge request's discussion is locked. If the discussion is locked only project members can add, edit or resolve comments. |
 
 Must include at least one non-required attribute from above.
 
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 88b592083db..0df41dcc903 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -48,7 +48,7 @@ module API
         optional :labels, type: String, desc: 'Comma-separated list of label names'
         optional :due_date, type: String, desc: 'Date string in the format YEAR-MONTH-DAY'
         optional :confidential, type: Boolean, desc: 'Boolean parameter if the issue should be confidential'
-        optional :discussion_locked, type: Boolean, desc: "Boolean parameter if the issue's discussion should be locked"
+        optional :discussion_locked, type: Boolean, desc: " Boolean parameter indicating if the issue's discussion is locked"
       end
 
       params :issue_params do
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index b3db366d875..0b9ab4eeb05 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -71,8 +71,6 @@ module API
         post ":id/#{noteables_str}/:noteable_id/notes" do
           noteable = find_project_noteable(noteables_str, params[:noteable_id])
 
-          authorize! :create_note, user_project
-
           opts = {
             note: params[:body],
             noteable_type: noteables_str.classify,
@@ -80,15 +78,12 @@ module API
           }
 
           if can?(current_user, noteable_read_ability_name(noteable), noteable)
+            authorize! :create_note, noteable
+
             if params[:created_at] && (current_user.admin? || user_project.owner == current_user)
               opts[:created_at] = params[:created_at]
             end
 
-            noteable_type = opts[:noteable_type].to_s
-            noteable = Issue.find(opts[:noteable_id]) if noteable_type == 'Issue'
-            noteable = MergeRequest.find(opts[:noteable_id]) if noteable_type == 'MergeRequest'
-            authorize! :create_note, noteable if noteable
-
             note = ::Notes::CreateService.new(user_project, current_user, opts).execute
 
             if note.valid?
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 10edad462c1..6a6430dfc13 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -239,6 +239,15 @@ describe Projects::NotesController do
         merge_request.update_attribute(:discussion_locked, true)
       end
 
+      context 'when a noteable is not found' do
+        it 'returns 404 status' do
+          request_params[:note][:noteable_id] = 9999
+          post :create, request_params.merge(format: :json)
+
+          expect(response).to have_http_status(404)
+        end
+      end
+
       context 'when a user is a team member' do
         it 'returns 302 status for html' do
           post :create, request_params
diff --git a/spec/fixtures/api/schemas/public_api/v4/issues.json b/spec/fixtures/api/schemas/public_api/v4/issues.json
index 8c854a43fc6..b7d6dbff031 100644
--- a/spec/fixtures/api/schemas/public_api/v4/issues.json
+++ b/spec/fixtures/api/schemas/public_api/v4/issues.json
@@ -9,7 +9,7 @@
       "title": { "type": "string" },
       "description": { "type": ["string", "null"] },
       "state": { "type": "string" },
-      "discussion_locked": { "type": "boolean" },
+      "discussion_locked": { "type": ["boolean", "null"] },
       "created_at": { "type": "date" },
       "updated_at": { "type": "date" },
       "labels": {
diff --git a/spec/fixtures/api/schemas/public_api/v4/merge_requests.json b/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
index 3b42333bb10..5828be5255b 100644
--- a/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
+++ b/spec/fixtures/api/schemas/public_api/v4/merge_requests.json
@@ -72,7 +72,7 @@
       "user_notes_count": { "type": "integer" },
       "should_remove_source_branch": { "type": ["boolean", "null"] },
       "force_remove_source_branch": { "type": ["boolean", "null"] },
-      "discussion_locked": { "type": "boolean" },
+      "discussion_locked": { "type": ["boolean", "null"] },
       "web_url": { "type": "uri" },
       "time_stats": {
         "time_estimate": { "type": "integer" },
diff --git a/spec/policies/issuable_policy_spec.rb b/spec/policies/issuable_policy_spec.rb
index 9b399d764ea..2cf669e8191 100644
--- a/spec/policies/issuable_policy_spec.rb
+++ b/spec/policies/issuable_policy_spec.rb
@@ -16,7 +16,7 @@ describe IssuablePolicy, models: true do
 
       context 'when the user is a project member' do
         before do
-          project.team << [user, :guest]
+          project.add_guest(user)
         end
 
         it 'can create a note' do
diff --git a/spec/policies/note_policy_spec.rb b/spec/policies/note_policy_spec.rb
index 70a99ed0198..58d36a2c84e 100644
--- a/spec/policies/note_policy_spec.rb
+++ b/spec/policies/note_policy_spec.rb
@@ -5,9 +5,15 @@ describe NotePolicy, mdoels: true do
     let(:user) { create(:user) }
     let(:project) { create(:project, :public) }
     let(:issue) { create(:issue, project: project) }
-    let(:note) { create(:note, noteable: issue, author: user, project: project) }
 
-    let(:policies) { described_class.new(user, note) }
+    def policies(noteable = nil)
+      return @policies if @policies
+
+      noteable ||= issue
+      note = create(:note, noteable: noteable, author: user, project: project)
+
+      @policies = described_class.new(user, note)
+    end
 
     context 'when the project is public' do
       context 'when the note author is not a project member' do
@@ -19,6 +25,17 @@ describe NotePolicy, mdoels: true do
         end
       end
 
+      context 'when the noteable is a snippet' do
+        it 'can edit note' do
+          policies = policies(create(:project_snippet, project: project))
+
+          expect(policies).to be_allowed(:update_note)
+          expect(policies).to be_allowed(:admin_note)
+          expect(policies).to be_allowed(:resolve_note)
+          expect(policies).to be_allowed(:read_note)
+        end
+      end
+
       context 'when a discussion is locked' do
         before do
           issue.update_attribute(:discussion_locked, true)
@@ -29,7 +46,7 @@ describe NotePolicy, mdoels: true do
             project.add_developer(user)
           end
 
-          it 'can eddit a note' do
+          it 'can edit a note' do
             expect(policies).to be_allowed(:update_note)
             expect(policies).to be_allowed(:admin_note)
             expect(policies).to be_allowed(:resolve_note)
diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index f5882c0c74a..fb440fa551c 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -302,6 +302,40 @@ describe API::Notes do
         expect(private_issue.notes.reload).to be_empty
       end
     end
+
+    context 'when the merge request discussion is locked' do
+      before do
+        merge_request.update_attribute(:discussion_locked, true)
+      end
+
+      context 'when a user is a team member' do
+        subject { post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/notes", user), body: 'Hi!' }
+
+        it 'returns 200 status' do
+          subject
+
+          expect(response).to have_http_status(201)
+        end
+
+        it 'creates a new note' do
+          expect { subject }.to change { Note.count }.by(1)
+        end
+      end
+
+      context 'when a user is not a team member' do
+        subject { post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/notes", private_user), body: 'Hi!' }
+
+        it 'returns 403 status' do
+          subject
+
+          expect(response).to have_http_status(403)
+        end
+
+        it 'does not create a new note' do
+          expect { subject }.not_to change { Note.count }
+        end
+      end
+    end
   end
 
   describe "POST /projects/:id/noteable/:noteable_id/notes to test observer on create" do
diff --git a/spec/services/issues/update_service_spec.rb b/spec/services/issues/update_service_spec.rb
index 0ed4c2152bb..bcce827fe71 100644
--- a/spec/services/issues/update_service_spec.rb
+++ b/spec/services/issues/update_service_spec.rb
@@ -144,6 +144,13 @@ describe Issues::UpdateService, :mailer do
           expect(note).not_to be_nil
           expect(note.note).to eq 'changed title from **{-Old-} title** to **{+New+} title**'
         end
+
+        it 'creates system note about discussion lock' do
+          note = find_note('locked this issue')
+
+          expect(note).not_to be_nil
+          expect(note.note).to eq 'locked this issue'
+        end
       end
     end
 
diff --git a/spec/services/merge_requests/update_service_spec.rb b/spec/services/merge_requests/update_service_spec.rb
index a07b7ac2218..b11a1b31f32 100644
--- a/spec/services/merge_requests/update_service_spec.rb
+++ b/spec/services/merge_requests/update_service_spec.rb
@@ -125,6 +125,13 @@ describe MergeRequests::UpdateService, :mailer do
         expect(note.note).to eq 'changed target branch from `master` to `target`'
       end
 
+      it 'creates system note about discussion lock' do
+        note = find_note('locked this issue')
+
+        expect(note).not_to be_nil
+        expect(note.note).to eq 'locked this issue'
+      end
+
       context 'when not including source branch removal options' do
         before do
           opts.delete(:force_remove_source_branch)
-- 
cgit v1.2.1


From a319418d9c050097a797fbf4f890cebd5256ed43 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 12:01:07 +0100
Subject: Merge FE

---
 .../notes/components/issue_comment_form.vue        |  27 ++++--
 .../notes/components/issue_note_form.vue           |  20 ++--
 .../javascripts/notes/mixins/issuable_state.js     |  15 +++
 .../confidential/confidential_issue_sidebar.vue    |  14 +--
 .../sidebar/components/confidential/edit_form.vue  |   9 +-
 .../components/confidential/edit_form_buttons.vue  |   6 +-
 .../sidebar/components/lock/edit_form.vue          |  62 ++++++++++++
 .../sidebar/components/lock/edit_form_buttons.vue  |  50 ++++++++++
 .../sidebar/components/lock/lock_issue_sidebar.vue | 108 +++++++++++++++++++++
 app/assets/javascripts/sidebar/sidebar_bundle.js   |  70 +++++++++----
 .../javascripts/sidebar/stores/sidebar_store.js    |   1 +
 .../issue/confidential_issue_warning.vue           |  16 ---
 .../vue_shared/components/issue/issue_warning.vue  |  53 ++++++++++
 .../javascripts/vue_shared/mixins/issuable.js      |   7 ++
 app/assets/stylesheets/framework/buttons.scss      |   4 +
 app/assets/stylesheets/framework/variables.scss    |   5 +
 app/assets/stylesheets/pages/issuable.scss         |  27 +++---
 app/assets/stylesheets/pages/note_form.scss        |  16 +--
 app/views/projects/_md_preview.html.haml           |   7 ++
 app/views/projects/issues/show.html.haml           |   5 +-
 .../projects/merge_requests/_mr_title.html.haml    |   2 +
 app/views/shared/issuable/_sidebar.html.haml       |   4 +
 spec/features/issues_spec.rb                       |  12 +--
 .../sidebar/lock/edit_form_buttons_spec.js         |  36 +++++++
 spec/javascripts/sidebar/lock/edit_form_spec.js    |  41 ++++++++
 .../sidebar/lock/lock_issue_sidebar_spec.js        |  73 ++++++++++++++
 .../issue/confidential_issue_warning_spec.js       |  20 ----
 .../components/issue/issue_warning_spec.js         |  45 +++++++++
 28 files changed, 644 insertions(+), 111 deletions(-)
 create mode 100644 app/assets/javascripts/notes/mixins/issuable_state.js
 create mode 100644 app/assets/javascripts/sidebar/components/lock/edit_form.vue
 create mode 100644 app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
 create mode 100644 app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
 delete mode 100644 app/assets/javascripts/vue_shared/components/issue/confidential_issue_warning.vue
 create mode 100644 app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
 create mode 100644 app/assets/javascripts/vue_shared/mixins/issuable.js
 create mode 100644 spec/javascripts/sidebar/lock/edit_form_buttons_spec.js
 create mode 100644 spec/javascripts/sidebar/lock/edit_form_spec.js
 create mode 100644 spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
 delete mode 100644 spec/javascripts/vue_shared/components/issue/confidential_issue_warning_spec.js
 create mode 100644 spec/javascripts/vue_shared/components/issue/issue_warning_spec.js

diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index 16f4e22aa9b..391a1960eae 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -6,10 +6,11 @@
   import TaskList from '../../task_list';
   import * as constants from '../constants';
   import eventHub from '../event_hub';
-  import confidentialIssue from '../../vue_shared/components/issue/confidential_issue_warning.vue';
+  import issueWarning from '../../vue_shared/components/issue/issue_warning.vue';
   import issueNoteSignedOutWidget from './issue_note_signed_out_widget.vue';
   import markdownField from '../../vue_shared/components/markdown/field.vue';
   import userAvatarLink from '../../vue_shared/components/user_avatar/user_avatar_link.vue';
+  import issuableStateMixin from '../mixins/issuable_state';
 
   export default {
     name: 'issueCommentForm',
@@ -25,7 +26,7 @@
       };
     },
     components: {
-      confidentialIssue,
+      issueWarning,
       issueNoteSignedOutWidget,
       markdownField,
       userAvatarLink,
@@ -54,6 +55,9 @@
       isIssueOpen() {
         return this.issueState === constants.OPENED || this.issueState === constants.REOPENED;
       },
+      canCreate() {
+        return this.getIssueData.current_user.can_create_note;
+      },
       issueActionButtonTitle() {
         if (this.note.length) {
           const actionText = this.isIssueOpen ? 'close' : 'reopen';
@@ -89,9 +93,6 @@
       endpoint() {
         return this.getIssueData.create_note_path;
       },
-      isConfidentialIssue() {
-        return this.getIssueData.confidential;
-      },
     },
     methods: {
       ...mapActions([
@@ -206,6 +207,9 @@
         });
       },
     },
+    mixins: [
+      issuableStateMixin,
+    ],
     mounted() {
       // jQuery is needed here because it is a custom event being dispatched with jQuery.
       $(document).on('issuable:change', (e, isClosed) => {
@@ -239,15 +243,22 @@
           <div class="timeline-content timeline-content-form">
             <form
               ref="commentForm"
-              class="new-note js-quick-submit common-note-form gfm-form js-main-target-form">
-              <confidentialIssue v-if="isConfidentialIssue" />
+              class="new-note js-quick-submit common-note-form gfm-form js-main-target-form"
+            >
+
+              <issue-warning
+                v-if="hasIssueWarning(getIssueData)"
+                :is-locked="isIssueLocked(getIssueData)"
+                :is-confidential="isIssueConfidential(getIssueData)"
+              />
+
               <div class="error-alert"></div>
               <markdown-field
                 :markdown-preview-path="markdownPreviewPath"
                 :markdown-docs-path="markdownDocsPath"
                 :quick-actions-docs-path="quickActionsDocsPath"
                 :add-spacing-classes="false"
-                :is-confidential-issue="isConfidentialIssue">
+                :is-confidential-issue="isIssueConfidential(getIssueData)">
                 <textarea
                   id="note-body"
                   name="note[note]"
diff --git a/app/assets/javascripts/notes/components/issue_note_form.vue b/app/assets/javascripts/notes/components/issue_note_form.vue
index 626c0f2ce18..f78289e68aa 100644
--- a/app/assets/javascripts/notes/components/issue_note_form.vue
+++ b/app/assets/javascripts/notes/components/issue_note_form.vue
@@ -1,8 +1,9 @@
 <script>
   import { mapGetters } from 'vuex';
   import eventHub from '../event_hub';
-  import confidentialIssue from '../../vue_shared/components/issue/confidential_issue_warning.vue';
+  import issueWarning from '../../vue_shared/components/issue/issue_warning.vue';
   import markdownField from '../../vue_shared/components/markdown/field.vue';
+  import issuableStateMixin from '../mixins/issuable_state';
 
   export default {
     name: 'issueNoteForm',
@@ -39,12 +40,13 @@
       };
     },
     components: {
-      confidentialIssue,
+      issueWarning,
       markdownField,
     },
     computed: {
       ...mapGetters([
         'getDiscussionLastNote',
+        'getIssueData',
         'getIssueDataByProp',
         'getNotesDataByProp',
         'getUserDataByProp',
@@ -67,9 +69,6 @@
       isDisabled() {
         return !this.note.length || this.isSubmitting;
       },
-      isConfidentialIssue() {
-        return this.getIssueDataByProp('confidential');
-      },
     },
     methods: {
       handleUpdate() {
@@ -95,6 +94,9 @@
         this.$emit('cancelFormEdition', shouldConfirm, this.noteBody !== this.note);
       },
     },
+    mixins: [
+      issuableStateMixin,
+    ],
     mounted() {
       this.$refs.textarea.focus();
     },
@@ -125,7 +127,13 @@
     <div class="flash-container timeline-content"></div>
     <form
       class="edit-note common-note-form js-quick-submit gfm-form">
-      <confidentialIssue v-if="isConfidentialIssue" />
+
+      <issue-warning
+        v-if="hasIssueWarning(getIssueData)"
+        :is-locked="isIssueLocked(getIssueData)"
+        :is-confidential="isIssueConfidential(getIssueData)"
+      />
+
       <markdown-field
         :markdown-preview-path="markdownPreviewPath"
         :markdown-docs-path="markdownDocsPath"
diff --git a/app/assets/javascripts/notes/mixins/issuable_state.js b/app/assets/javascripts/notes/mixins/issuable_state.js
new file mode 100644
index 00000000000..a0b3d81d63b
--- /dev/null
+++ b/app/assets/javascripts/notes/mixins/issuable_state.js
@@ -0,0 +1,15 @@
+export default {
+  methods: {
+    isIssueConfidential(issue) {
+      return !!issue.confidential;
+    },
+
+    isIssueLocked(issue) {
+      return !!issue.discussion_locked;
+    },
+
+    hasIssueWarning(issue) {
+      return this.isIssueConfidential(issue) || this.isIssueLocked(issue);
+    },
+  },
+};
diff --git a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
index 8e7abdbffef..dfdd00cff47 100644
--- a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
@@ -47,9 +47,9 @@ export default {
 </script>
 
 <template>
-  <div class="block confidentiality">
+  <div class="block issuable-sidebar-item confidentiality">
     <div class="sidebar-collapsed-icon">
-      <i class="fa" :class="faEye" aria-hidden="true" data-hidden="true"></i>
+      <i class="fa" :class="faEye" aria-hidden="true"></i>
     </div>
     <div class="title hide-collapsed">
       Confidentiality
@@ -62,19 +62,19 @@ export default {
         Edit
       </a>
     </div>
-    <div class="value confidential-value hide-collapsed">
+    <div class="value sidebar-item-value hide-collapsed">
       <editForm
         v-if="edit"
         :toggle-form="toggleForm"
         :is-confidential="isConfidential"
         :update-confidential-attribute="updateConfidentialAttribute"
       />
-      <div v-if="!isConfidential" class="no-value confidential-value">
-        <i class="fa fa-eye is-not-confidential"></i>
+      <div v-if="!isConfidential" class="no-value sidebar-item-value">
+        <i class="fa fa-eye not-active"></i>
         Not confidential
       </div>
-      <div v-else class="value confidential-value hide-collapsed">
-        <i aria-hidden="true" data-hidden="true" class="fa fa-eye-slash is-confidential"></i>
+      <div v-else class="value sidebar-item-value hide-collapsed">
+        <i aria-hidden="true" class="fa fa-eye-slash is-active"></i>
         This issue is confidential
       </div>
     </div>
diff --git a/app/assets/javascripts/sidebar/components/confidential/edit_form.vue b/app/assets/javascripts/sidebar/components/confidential/edit_form.vue
index d578b663a54..dd17b5abd46 100644
--- a/app/assets/javascripts/sidebar/components/confidential/edit_form.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/edit_form.vue
@@ -2,9 +2,6 @@
 import editFormButtons from './edit_form_buttons.vue';
 
 export default {
-  components: {
-    editFormButtons,
-  },
   props: {
     isConfidential: {
       required: true,
@@ -19,12 +16,16 @@ export default {
       type: Function,
     },
   },
+
+  components: {
+    editFormButtons,
+  },
 };
 </script>
 
 <template>
   <div class="dropdown open">
-    <div class="dropdown-menu confidential-warning-message">
+    <div class="dropdown-menu sidebar-item-warning-message">
       <div>
         <p v-if="!isConfidential">
           You are going to turn on the confidentiality. This means that only team members with
diff --git a/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue b/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
index 97af4a3f505..143f8ae7bc1 100644
--- a/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
@@ -15,7 +15,7 @@ export default {
     },
   },
   computed: {
-    onOrOff() {
+    buttonText() {
       return this.isConfidential ? 'Turn Off' : 'Turn On';
     },
     updateConfidentialBool() {
@@ -26,7 +26,7 @@ export default {
 </script>
 
 <template>
-  <div class="confidential-warning-message-actions">
+  <div class="sidebar-item-warning-message-actions">
     <button
       type="button"
       class="btn btn-default append-right-10"
@@ -39,7 +39,7 @@ export default {
       class="btn btn-close"
       @click.prevent="updateConfidentialAttribute(updateConfidentialBool)"
     >
-      {{ onOrOff }}
+      {{ buttonText }}
     </button>
   </div>
 </template>
diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form.vue b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
new file mode 100644
index 00000000000..616abec4d5e
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
@@ -0,0 +1,62 @@
+<script>
+import editFormButtons from './edit_form_buttons.vue';
+import issuableMixin from '../../../vue_shared/mixins/issuable';
+
+export default {
+  props: {
+    isLocked: {
+      required: true,
+      type: Boolean,
+    },
+
+    toggleForm: {
+      required: true,
+      type: Function,
+    },
+
+    updateLockedAttribute: {
+      required: true,
+      type: Function,
+    },
+
+    issuableType: {
+      required: true,
+      type: String,
+    },
+  },
+
+  mixins: [
+    issuableMixin,
+  ],
+
+  components: {
+    editFormButtons,
+  },
+};
+</script>
+
+<template>
+  <div class="dropdown open">
+    <div class="dropdown-menu sidebar-item-warning-message">
+      <div>
+        <p v-if="isLocked">
+          {{ __(`Unlock this ${issuableDisplayName(issuableType)}?`) }}
+          <strong>{{ __('Everyone') }}</strong>
+          {{ __('will be able to comment.') }}
+        </p>
+
+        <p v-else>
+          {{ __(`Lock this ${issuableDisplayName(issuableType)}? Only`) }}
+          <strong>{{ __('project members') }}</strong>
+          {{ __('will be able to comment.') }}
+        </p>
+
+        <edit-form-buttons
+          :is-locked="isLocked"
+          :toggle-form="toggleForm"
+          :update-locked-attribute="updateLockedAttribute"
+        />
+      </div>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue b/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
new file mode 100644
index 00000000000..7d883704142
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
@@ -0,0 +1,50 @@
+<script>
+export default {
+  props: {
+    isLocked: {
+      required: true,
+      type: Boolean,
+    },
+
+    toggleForm: {
+      required: true,
+      type: Function,
+    },
+
+    updateLockedAttribute: {
+      required: true,
+      type: Function,
+    },
+  },
+
+  computed: {
+    buttonText() {
+      return this.isLocked ? this.__('Unlock') : this.__('Lock');
+    },
+
+    updateLockedBool() {
+      return !this.isLocked;
+    },
+  },
+};
+</script>
+
+<template>
+  <div class="sidebar-item-warning-message-actions">
+    <button
+      type="button"
+      class="btn btn-default append-right-10"
+      @click="toggleForm"
+    >
+      {{ __('Cancel') }}
+    </button>
+
+    <button
+      type="button"
+      class="btn btn-close"
+      @click.prevent="updateLockedAttribute(updateLockedBool)"
+    >
+      {{ buttonText }}
+    </button>
+  </div>
+</template>
diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
new file mode 100644
index 00000000000..c24edf6154d
--- /dev/null
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -0,0 +1,108 @@
+<script>
+/* global Flash */
+import editForm from './edit_form.vue';
+import issuableMixin from '../../../vue_shared/mixins/issuable';
+
+export default {
+  props: {
+    isLocked: {
+      required: true,
+      type: Boolean,
+    },
+
+    isEditable: {
+      required: true,
+      type: Boolean,
+    },
+
+    mediator: {
+      required: true,
+      type: Object,
+      validator(mediatorObject) {
+        return mediatorObject.service && mediatorObject.service.update && mediatorObject.store;
+      },
+    },
+
+    issuableType: {
+      required: true,
+      type: String,
+    },
+  },
+
+  mixins: [
+    issuableMixin,
+  ],
+
+  components: {
+    editForm,
+  },
+
+  computed: {
+    lockIconClass() {
+      return this.isLocked ? 'fa-lock' : 'fa-unlock';
+    },
+
+    isLockDialogOpen() {
+      return this.mediator.store.isLockDialogOpen;
+    },
+  },
+
+  methods: {
+    toggleForm() {
+      this.mediator.store.isLockDialogOpen = !this.mediator.store.isLockDialogOpen;
+    },
+
+    updateLockedAttribute(locked) {
+      this.mediator.service.update(this.issuableType, {
+        discussion_locked: locked,
+      })
+      .then(() => location.reload())
+      .catch(() => Flash(this.__(`Something went wrong trying to change the locked state of this ${issuableDisplayName(this.issuableType)}`)));
+    },
+  },
+};
+</script>
+
+<template>
+  <div class="block issuable-sidebar-item lock">
+    <div class="sidebar-collapsed-icon">
+      <i
+        class="fa"
+        :class="lockIconClass"
+        aria-hidden="true"
+      ></i>
+    </div>
+
+    <div class="title hide-collapsed">
+      {{ __(`Lock ${issuableDisplayName(issuableType)}`) }}
+      <button
+        v-if="isEditable"
+        class="pull-right lock-edit btn btn-blank"
+        type="button"
+        @click.prevent="toggleForm"
+      >
+        {{ __('Edit') }}
+      </button>
+    </div>
+
+    <div class="value sidebar-item-value hide-collapsed">
+      <editForm
+        v-if="isLockDialogOpen"
+        :toggle-form="toggleForm"
+        :is-locked="isLocked"
+        :update-locked-attribute="updateLockedAttribute"
+        :issuable-type="issuableType"
+      />
+
+      <div v-if="isLocked" class="value sidebar-item-value">
+        <i aria-hidden="true" class="fa fa-lock is-active"></i>
+        {{ __('Locked') }}
+      </div>
+
+      <div v-else class="no-value sidebar-item-value hide-collapsed">
+        <i aria-hidden="true" class="fa fa-unlock not-active"></i>
+        {{ __('Unlocked') }}
+      </div>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/sidebar/sidebar_bundle.js b/app/assets/javascripts/sidebar/sidebar_bundle.js
index 3d8972050a9..645e65d7b16 100644
--- a/app/assets/javascripts/sidebar/sidebar_bundle.js
+++ b/app/assets/javascripts/sidebar/sidebar_bundle.js
@@ -3,42 +3,72 @@ import sidebarTimeTracking from './components/time_tracking/sidebar_time_trackin
 import sidebarAssignees from './components/assignees/sidebar_assignees';
 import confidential from './components/confidential/confidential_issue_sidebar.vue';
 import SidebarMoveIssue from './lib/sidebar_move_issue';
+import lockBlock from './components/lock/lock_issue_sidebar.vue';
+import Translate from '../vue_shared/translate';
 
 import Mediator from './sidebar_mediator';
 
+Vue.use(Translate);
+
+function mountConfidentialComponent(mediator) {
+  const el = document.querySelector('#js-confidential-entry-point');
+
+  if (!el) return;
+
+  const dataNode = document.getElementById('js-confidential-issue-data');
+  const initialData = JSON.parse(dataNode.innerHTML);
+
+  const ConfidentialComp = Vue.extend(confidential);
+
+  new ConfidentialComp({
+    propsData: {
+      isConfidential: initialData.is_confidential,
+      isEditable: initialData.is_editable,
+      service: mediator.service,
+    },
+  }).$mount(el);
+}
+
+function mountLockComponent(mediator) {
+  const el = document.querySelector('#js-lock-entry-point');
+
+  if (!el) return;
+
+  const dataNode = document.getElementById('js-lock-issue-data');
+  const initialData = JSON.parse(dataNode.innerHTML);
+
+  const LockComp = Vue.extend(lockBlock);
+
+  new LockComp({
+    propsData: {
+      isLocked: initialData.is_locked,
+      isEditable: initialData.is_editable,
+      mediator,
+      issuableType: gl.utils.isInIssuePage() ? 'issue' : 'merge_request',
+    },
+  }).$mount(el);
+}
+
 function domContentLoaded() {
   const sidebarOptions = JSON.parse(document.querySelector('.js-sidebar-options').innerHTML);
   const mediator = new Mediator(sidebarOptions);
   mediator.fetch();
 
   const sidebarAssigneesEl = document.querySelector('#js-vue-sidebar-assignees');
-  const confidentialEl = document.querySelector('#js-confidential-entry-point');
   // Only create the sidebarAssignees vue app if it is found in the DOM
   // We currently do not use sidebarAssignees for the MR page
   if (sidebarAssigneesEl) {
     new Vue(sidebarAssignees).$mount(sidebarAssigneesEl);
   }
 
-  if (confidentialEl) {
-    const dataNode = document.getElementById('js-confidential-issue-data');
-    const initialData = JSON.parse(dataNode.innerHTML);
+  mountConfidentialComponent(mediator);
+  mountLockComponent(mediator);
 
-    const ConfidentialComp = Vue.extend(confidential);
-
-    new ConfidentialComp({
-      propsData: {
-        isConfidential: initialData.is_confidential,
-        isEditable: initialData.is_editable,
-        service: mediator.service,
-      },
-    }).$mount(confidentialEl);
-
-    new SidebarMoveIssue(
-      mediator,
-      $('.js-move-issue'),
-      $('.js-move-issue-confirmation-button'),
-    ).init();
-  }
+  new SidebarMoveIssue(
+    mediator,
+    $('.js-move-issue'),
+    $('.js-move-issue-confirmation-button'),
+  ).init();
 
   new Vue(sidebarTimeTracking).$mount('#issuable-time-tracker');
 }
diff --git a/app/assets/javascripts/sidebar/stores/sidebar_store.js b/app/assets/javascripts/sidebar/stores/sidebar_store.js
index cc04a2a3fcf..d5d04103f3f 100644
--- a/app/assets/javascripts/sidebar/stores/sidebar_store.js
+++ b/app/assets/javascripts/sidebar/stores/sidebar_store.js
@@ -15,6 +15,7 @@ export default class SidebarStore {
       };
       this.autocompleteProjects = [];
       this.moveToProjectId = 0;
+      this.isLockDialogOpen = false;
 
       SidebarStore.singleton = this;
     }
diff --git a/app/assets/javascripts/vue_shared/components/issue/confidential_issue_warning.vue b/app/assets/javascripts/vue_shared/components/issue/confidential_issue_warning.vue
deleted file mode 100644
index 397d16331d5..00000000000
--- a/app/assets/javascripts/vue_shared/components/issue/confidential_issue_warning.vue
+++ /dev/null
@@ -1,16 +0,0 @@
-<script>
-  export default {
-    name: 'confidentialIssueWarning',
-  };
-</script>
-<template>
-  <div class="confidential-issue-warning">
-    <i
-    aria-hidden="true"
-    class="fa fa-eye-slash">
-    </i>
-    <span>
-      This is a confidential issue. Your comment will not be visible to the public.
-    </span>
-  </div>
-</template>
diff --git a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
new file mode 100644
index 00000000000..0f11b6e2223
--- /dev/null
+++ b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
@@ -0,0 +1,53 @@
+<script>
+  export default {
+    props: {
+      isLocked: {
+        type: Boolean,
+        default: false,
+      },
+
+      isConfidential: {
+        type: Boolean,
+        default: false,
+      },
+    },
+
+    computed: {
+      iconClass() {
+        return {
+          'fa-eye-slash': this.isConfidential,
+          'fa-lock': this.isLocked,
+        };
+      },
+
+      isLockedAndConfidential() {
+        return this.isConfidential && this.isLocked;
+      },
+    },
+  };
+</script>
+<template>
+  <div class="issuable-note-warning">
+    <i
+      aria-hidden="true"
+      class="fa"
+      :class="iconClass"
+      v-if="!isLockedAndConfidential"
+    ></i>
+
+    <span v-if="isLockedAndConfidential">
+      {{ __('This issue is confidential and locked.') }}
+      {{ __('People without permission will never get a notification and not be able to comment.') }}
+    </span>
+
+    <span v-else-if="isConfidential">
+      {{ __('This is a confidential issue.') }}
+      {{ __('Your comment will not be visible to the public.') }}
+    </span>
+
+    <span v-else-if="isLocked">
+      {{ __('This issue is locked.') }}
+      {{ __('Only project members can comment.') }}
+    </span>
+  </div>
+</template>
diff --git a/app/assets/javascripts/vue_shared/mixins/issuable.js b/app/assets/javascripts/vue_shared/mixins/issuable.js
new file mode 100644
index 00000000000..831102c0cac
--- /dev/null
+++ b/app/assets/javascripts/vue_shared/mixins/issuable.js
@@ -0,0 +1,7 @@
+export default {
+  methods: {
+    issuableDisplayName(issuableType) {
+      return issuableType.replace(/_/, ' ');
+    },
+  },
+};
diff --git a/app/assets/stylesheets/framework/buttons.scss b/app/assets/stylesheets/framework/buttons.scss
index 82350c36df0..fc1cd81ec67 100644
--- a/app/assets/stylesheets/framework/buttons.scss
+++ b/app/assets/stylesheets/framework/buttons.scss
@@ -385,7 +385,11 @@
   background: transparent;
   border: 0;
 
+  &:hover,
+  &:active,
   &:focus {
     outline: 0;
+    background: transparent;
+    box-shadow: none;
   }
 }
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 3857226cddb..594b0bb0556 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -694,3 +694,8 @@ Project Templates Icons
 $rails: #c00;
 $node: #353535;
 $java: #70ad51;
+
+/*
+Issuable warning
+*/
+$issuable-warning-size: 24px;
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index d01ee4b033c..e0083be7be9 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -5,27 +5,28 @@
   margin-right: auto;
 }
 
-.is-confidential {
+.issuable-warning-icon {
   color: $orange-600;
   background-color: $orange-50;
   border-radius: $border-radius-default;
   padding: 5px;
-  margin: 0 3px 0 -4px;
+  margin: 0 $btn-side-margin 0 0;
+  width: $issuable-warning-size;
+  height: $issuable-warning-size;
+  text-align: center;
 }
 
-.is-not-confidential {
-  border-radius: $border-radius-default;
-  padding: 5px;
-  margin: 0 3px 0 -4px;
-}
-
-.confidentiality {
-  .is-not-confidential {
-    margin: auto;
+.issuable-sidebar-item {
+  .not-active,
+  .is-active {
+    border-radius: $border-radius-default;
+    padding: 5px;
+    margin: 0 3px 0 -4px;
   }
 
-  .is-confidential {
-    margin: auto;
+  .is-active {
+    color: $orange-600;
+    background-color: $orange-50;
   }
 }
 
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index 5d7c85b16ef..c2904ce2273 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -1,7 +1,7 @@
 /**
  * Note Form
  */
-.comment-btn {
+ .comment-btn {
   @extend .btn-create;
 }
 
@@ -101,7 +101,7 @@
   }
 }
 
-.confidential-issue-warning {
+.issuable-note-warning {
   color: $orange-600;
   background-color: $orange-50;
   border-radius: $border-radius-default $border-radius-default 0 0;
@@ -112,17 +112,21 @@
   align-items: center;
 }
 
-.confidential-value {
+.sidebar-item-value {
   .fa {
     background-color: inherit;
   }
 }
 
-.confidential-warning-message {
+.sidebar-item-warning-message {
   line-height: 1.5;
   padding: 16px;
 
-  .confidential-warning-message-actions {
+  p {
+    color: $text-color;
+  }
+
+  .sidebar-item-warning-message-actions {
     display: flex;
 
     button {
@@ -131,7 +135,7 @@
   }
 }
 
-.confidential-issue-warning + .md-area {
+.issuable-note-warning + .md-area {
   border-top-left-radius: 0;
   border-top-right-radius: 0;
 }
diff --git a/app/views/projects/_md_preview.html.haml b/app/views/projects/_md_preview.html.haml
index 71424593f2e..d56a2b58955 100644
--- a/app/views/projects/_md_preview.html.haml
+++ b/app/views/projects/_md_preview.html.haml
@@ -1,5 +1,12 @@
 - referenced_users = local_assigns.fetch(:referenced_users, nil)
 
+- if defined?(@merge_request) && @merge_request.discussion_locked?
+.issuable-note-warning
+  = icon('lock')
+  %span
+    = _('This merge request is locked.')
+    = _('Only project members can comment.')
+
 .md-area
   .md-header
     %ul.nav-links.clearfix
diff --git a/app/views/projects/issues/show.html.haml b/app/views/projects/issues/show.html.haml
index fbaf88356bf..b8dcd654739 100644
--- a/app/views/projects/issues/show.html.haml
+++ b/app/views/projects/issues/show.html.haml
@@ -27,8 +27,9 @@
 
     .issuable-meta
       - if @issue.confidential
-        = icon('eye-slash', class: 'is-confidential')
-      = issuable_meta(@issue, @project, "Issue")
+        = icon('eye-slash', class: 'issuable-warning-icon')
+      - if @issue.discussion_locked?
+        = icon('lock', class: 'issuable-warning-icon')
 
   .issuable-actions.js-issuable-actions
     .clearfix.issue-btn-group.dropdown
diff --git a/app/views/projects/merge_requests/_mr_title.html.haml b/app/views/projects/merge_requests/_mr_title.html.haml
index f3c44c94a5c..4033e00f538 100644
--- a/app/views/projects/merge_requests/_mr_title.html.haml
+++ b/app/views/projects/merge_requests/_mr_title.html.haml
@@ -15,6 +15,8 @@
       = icon('angle-double-left')
 
     .issuable-meta
+      - if @merge_request.discussion_locked
+        = icon('lock', class: 'issuable-warning-icon')
       = issuable_meta(@merge_request, @project, "Merge request")
 
   .issuable-actions.js-issuable-actions
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index 38a54c232d0..e0b987b9f8d 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -119,6 +119,10 @@
         %script#js-confidential-issue-data{ type: "application/json" }= { is_confidential: @issue.confidential, is_editable: can_edit_issuable }.to_json.html_safe
         #js-confidential-entry-point
 
+      - if issuable.has_attribute?(:discussion_locked)
+        %script#js-lock-issue-data{ type: "application/json" }= { is_locked: issuable.discussion_locked?, is_editable: can_edit_issuable }.to_json.html_safe
+        #js-lock-entry-point
+
       = render "shared/issuable/participants", participants: issuable.participants(current_user)
       - if current_user
         - subscribed = issuable.subscribed?(current_user, @project)
diff --git a/spec/features/issues_spec.rb b/spec/features/issues_spec.rb
index 5c284a1fe5f..5a8aed6a0fd 100644
--- a/spec/features/issues_spec.rb
+++ b/spec/features/issues_spec.rb
@@ -725,14 +725,14 @@ describe 'Issues' do
 
       visit project_issue_path(project, issue)
 
-      expect(page).to have_css('.confidential-issue-warning')
-      expect(page).to have_css('.is-confidential')
-      expect(page).not_to have_css('.is-not-confidential')
+      expect(page).to have_css('.issuable-note-warning')
+      expect(find('.issuable-sidebar-item.confidentiality')).to have_css('.is-active')
+      expect(find('.issuable-sidebar-item.confidentiality')).not_to have_css('.not-active')
 
       find('.confidential-edit').click
-      expect(page).to have_css('.confidential-warning-message')
+      expect(page).to have_css('.sidebar-item-warning-message')
 
-      within('.confidential-warning-message') do
+      within('.sidebar-item-warning-message') do
         find('.btn-close').click
       end
 
@@ -740,7 +740,7 @@ describe 'Issues' do
 
       visit project_issue_path(project, issue)
 
-      expect(page).not_to have_css('.is-confidential')
+      expect(page).not_to have_css('.is-active')
     end
   end
 end
diff --git a/spec/javascripts/sidebar/lock/edit_form_buttons_spec.js b/spec/javascripts/sidebar/lock/edit_form_buttons_spec.js
new file mode 100644
index 00000000000..b0ea8ae0206
--- /dev/null
+++ b/spec/javascripts/sidebar/lock/edit_form_buttons_spec.js
@@ -0,0 +1,36 @@
+import Vue from 'vue';
+import editFormButtons from '~/sidebar/components/lock/edit_form_buttons.vue';
+import mountComponent from '../../helpers/vue_mount_component_helper';
+
+describe('EditFormButtons', () => {
+  let vm1;
+  let vm2;
+
+  beforeEach(() => {
+    const Component = Vue.extend(editFormButtons);
+    const toggleForm = () => { };
+    const updateLockedAttribute = () => { };
+
+    vm1 = mountComponent(Component, {
+      isLocked: true,
+      toggleForm,
+      updateLockedAttribute,
+    });
+
+    vm2 = mountComponent(Component, {
+      isLocked: false,
+      toggleForm,
+      updateLockedAttribute,
+    });
+  });
+
+  it('renders unlock or lock text based on locked state', () => {
+    expect(
+      vm1.$el.innerHTML.includes('Unlock'),
+    ).toBe(true);
+
+    expect(
+      vm2.$el.innerHTML.includes('Lock'),
+    ).toBe(true);
+  });
+});
diff --git a/spec/javascripts/sidebar/lock/edit_form_spec.js b/spec/javascripts/sidebar/lock/edit_form_spec.js
new file mode 100644
index 00000000000..7abd6997a18
--- /dev/null
+++ b/spec/javascripts/sidebar/lock/edit_form_spec.js
@@ -0,0 +1,41 @@
+import Vue from 'vue';
+import editForm from '~/sidebar/components/lock/edit_form.vue';
+
+describe('EditForm', () => {
+  let vm1;
+  let vm2;
+
+  beforeEach(() => {
+    const Component = Vue.extend(editForm);
+    const toggleForm = () => { };
+    const updateLockedAttribute = () => { };
+
+    vm1 = new Component({
+      propsData: {
+        isLocked: true,
+        toggleForm,
+        updateLockedAttribute,
+        issuableType: 'issue',
+      },
+    }).$mount();
+
+    vm2 = new Component({
+      propsData: {
+        isLocked: false,
+        toggleForm,
+        updateLockedAttribute,
+        issuableType: 'merge_request',
+      },
+    }).$mount();
+  });
+
+  it('renders on the appropriate warning text', () => {
+    expect(
+      vm1.$el.innerHTML.includes('Unlock this issue?'),
+    ).toBe(true);
+
+    expect(
+      vm2.$el.innerHTML.includes('Lock this merge request?'),
+    ).toBe(true);
+  });
+});
diff --git a/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
new file mode 100644
index 00000000000..2848be62819
--- /dev/null
+++ b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
@@ -0,0 +1,73 @@
+import Vue from 'vue';
+import lockIssueSidebar from '~/sidebar/components/lock/lock_issue_sidebar.vue';
+
+describe('LockIssueSidebar', () => {
+  let vm1;
+  let vm2;
+
+  beforeEach(() => {
+    const Component = Vue.extend(lockIssueSidebar);
+
+    const mediator = {
+      service: {
+        update: () => new Promise((resolve) => {
+          resolve(true);
+        }),
+      },
+
+      store: {
+        isLockDialogOpen: false,
+      },
+    };
+
+    vm1 = new Component({
+      propsData: {
+        isLocked: true,
+        isEditable: true,
+        mediator,
+        issuableType: 'issue',
+      },
+    }).$mount();
+
+    vm2 = new Component({
+      propsData: {
+        isLocked: false,
+        isEditable: false,
+        mediator,
+        issuableType: 'merge_request',
+      },
+    }).$mount();
+  });
+
+  it('shows if locked and/or editable', () => {
+    expect(
+      vm1.$el.innerHTML.includes('Edit'),
+    ).toBe(true);
+
+    expect(
+      vm1.$el.innerHTML.includes('Locked'),
+    ).toBe(true);
+
+    expect(
+      vm2.$el.innerHTML.includes('Unlocked'),
+    ).toBe(true);
+  });
+
+  it('displays the edit form when editable', (done) => {
+    expect(vm1.isLockDialogOpen).toBe(false);
+
+    vm1.$el.querySelector('.lock-edit').click();
+
+    expect(vm1.isLockDialogOpen).toBe(true);
+
+    vm1.$nextTick(() => {
+      expect(
+        vm1.$el
+          .innerHTML
+          .includes('Unlock this issue?'),
+      ).toBe(true);
+
+      done();
+    });
+  });
+});
diff --git a/spec/javascripts/vue_shared/components/issue/confidential_issue_warning_spec.js b/spec/javascripts/vue_shared/components/issue/confidential_issue_warning_spec.js
deleted file mode 100644
index 6df08f3ebe7..00000000000
--- a/spec/javascripts/vue_shared/components/issue/confidential_issue_warning_spec.js
+++ /dev/null
@@ -1,20 +0,0 @@
-import Vue from 'vue';
-import confidentialIssue from '~/vue_shared/components/issue/confidential_issue_warning.vue';
-
-describe('Confidential Issue Warning Component', () => {
-  let vm;
-
-  beforeEach(() => {
-    const Component = Vue.extend(confidentialIssue);
-    vm = new Component().$mount();
-  });
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  it('should render confidential issue warning information', () => {
-    expect(vm.$el.querySelector('i').className).toEqual('fa fa-eye-slash');
-    expect(vm.$el.querySelector('span').textContent.trim()).toEqual('This is a confidential issue. Your comment will not be visible to the public.');
-  });
-});
diff --git a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
new file mode 100644
index 00000000000..c366589ec50
--- /dev/null
+++ b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
@@ -0,0 +1,45 @@
+import Vue from 'vue';
+import issueWarning from '~/vue_shared/components/issue/issue_warning.vue';
+import mountComponent from '../../../helpers/vue_mount_component_helper';
+
+const IssueWarning = Vue.extend(issueWarning);
+
+function formatWarning(string) {
+  return string.trim().replace(/\n/g, ' ').replace(/\s\s+/g, ' ');
+}
+
+describe('Issue Warning Component', () => {
+  describe('isLocked', () => {
+    it('should render locked issue warning information', () => {
+      const vm = mountComponent(IssueWarning, {
+        isLocked: true,
+      });
+
+      expect(vm.$el.querySelector('i').className).toEqual('fa fa-lock');
+      expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This issue is locked. Only project members can comment.');
+    });
+  });
+
+  describe('isConfidential', () => {
+    it('should render confidential issue warning information', () => {
+      const vm = mountComponent(IssueWarning, {
+        isConfidential: true,
+      });
+
+      expect(vm.$el.querySelector('i').className).toEqual('fa fa-eye-slash');
+      expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This is a confidential issue. Your comment will not be visible to the public.');
+    });
+  });
+
+  describe('isLocked and isConfidential', () => {
+    it('should render locked and confidential issue warning information', () => {
+      const vm = mountComponent(IssueWarning, {
+        isLocked: true,
+        isConfidential: true,
+      });
+
+      expect(vm.$el.querySelector('i')).toBeFalsy();
+      expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This issue is confidential and locked. People without permission will never get a notification and not be able to comment.');
+    });
+  });
+});
-- 
cgit v1.2.1


From 579092f53aa1a27e8d60bd70e12bed19123e24e7 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 12:06:11 +0100
Subject: Remove discussion_lock

---
 app/assets/javascripts/discussion_lock.js          | 46 ----------------------
 app/assets/javascripts/main.js                     |  1 -
 .../projects/merge_requests/_mr_title.html.haml    |  2 +-
 app/views/shared/issuable/_sidebar.html.haml       | 11 ------
 db/schema.rb                                       | 32 +++++++--------
 5 files changed, 17 insertions(+), 75 deletions(-)
 delete mode 100644 app/assets/javascripts/discussion_lock.js

diff --git a/app/assets/javascripts/discussion_lock.js b/app/assets/javascripts/discussion_lock.js
deleted file mode 100644
index 7bf83e9b8a0..00000000000
--- a/app/assets/javascripts/discussion_lock.js
+++ /dev/null
@@ -1,46 +0,0 @@
-class DiscussionLock {
-  constructor(containerElm) {
-    this.containerElm = containerElm;
-
-    const lockButton = containerElm.querySelector('.js-discussion-lock-button');
-    console.log(lockButton);
-    if (lockButton) {
-      // remove class so we don't bind twice
-      lockButton.classList.remove('js-discussion-lock-button');
-      console.log(lockButton);
-      lockButton.addEventListener('click', this.toggleDiscussionLock.bind(this));
-    }
-  }
-
-  toggleDiscussionLock(event) {
-    const button = event.currentTarget;
-    const buttonSpan = button.querySelector('span');
-    if (!buttonSpan || button.classList.contains('disabled')) {
-      return;
-    }
-    button.classList.add('disabled');
-
-    const url = this.containerElm.dataset.url;
-    const lock = this.containerElm.dataset.lock;
-    const issuableType = this.containerElm.dataset.issuableType;
-
-    const data = {}
-    data[issuableType] = {}
-    data[issuableType].discussion_locked = lock
-
-    $.ajax({
-      url,
-      data: data,
-      type: 'PUT'
-    }).done((data) => {
-      button.classList.remove('disabled');
-    });
-  }
-
-  static bindAll(selector) {
-    [].forEach.call(document.querySelectorAll(selector), elm => new DiscussionLock(elm));
-  }
-}
-
-window.gl = window.gl || {};
-window.gl.DiscussionLock = DiscussionLock;
diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index ea1d50de965..0bc31a56684 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -80,7 +80,6 @@ import './copy_as_gfm';
 import './copy_to_clipboard';
 import './create_label';
 import './diff';
-import './discussion_lock';
 import './dropzone_input';
 import './due_date_select';
 import './files_comment_button';
diff --git a/app/views/projects/merge_requests/_mr_title.html.haml b/app/views/projects/merge_requests/_mr_title.html.haml
index 4033e00f538..941d9054337 100644
--- a/app/views/projects/merge_requests/_mr_title.html.haml
+++ b/app/views/projects/merge_requests/_mr_title.html.haml
@@ -15,7 +15,7 @@
       = icon('angle-double-left')
 
     .issuable-meta
-      - if @merge_request.discussion_locked
+      - if @merge_request.discussion_locked?
         = icon('lock', class: 'issuable-warning-icon')
       = issuable_meta(@merge_request, @project, "Merge request")
 
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index e0b987b9f8d..2e1c5f6e1b4 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -135,17 +135,6 @@
           %button.btn.btn-default.pull-right.js-subscribe-button.issuable-subscribe-button.hide-collapsed{ type: "button" }
             %span= subscribed ? 'Unsubscribe' : 'Subscribe'
 
-      - if can_edit_issuable
-        - locked = issuable.discussion_locked?
-        .block.light.discussion-lock{ data: { lock: (!locked).to_s, url: "#{issuable_json_path(issuable)}?basic=true", issuable_type: issuable.class.to_s.underscore } }
-          .sidebar-collapsed-icon
-            = icon('rss', 'aria-hidden': 'true')
-          %span.issuable-header-text.hide-collapsed.pull-left
-            Discussion Lock
-          - subscribtion_status = locked ? 'locked' : 'not locked'
-          %button.btn.btn-default.pull-right.js-discussion-lock-button.issuable-discussion-lock-button.hide-collapsed{ type: "button" }
-            %span= locked ? 'Unlock' : 'Lock'
-
       - project_ref = cross_project_reference(@project, issuable)
       .block.project-reference
         .sidebar-collapsed-icon.dont-change-state
diff --git a/db/schema.rb b/db/schema.rb
index 6cdf929b1b6..ceaa7a7deea 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -32,8 +32,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.text "description", null: false
     t.string "header_logo"
     t.string "logo"
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.text "description_html"
     t.integer "cached_markdown_version"
   end
@@ -275,8 +275,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.string "encrypted_value_iv"
     t.integer "group_id", null: false
     t.boolean "protected", default: false, null: false
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
   end
 
   add_index "ci_group_variables", ["group_id", "key"], name: "index_ci_group_variables_on_group_id_and_key", unique: true, using: :btree
@@ -288,8 +288,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.string "encrypted_value_salt"
     t.string "encrypted_value_iv"
     t.integer "pipeline_schedule_id", null: false
-    t.datetime_with_timezone "created_at"
-    t.datetime_with_timezone "updated_at"
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "ci_pipeline_schedule_variables", ["pipeline_schedule_id", "key"], name: "index_ci_pipeline_schedule_variables_on_schedule_id_and_key", unique: true, using: :btree
@@ -537,8 +537,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
     t.integer "project_id"
     t.integer "author_id", null: false
     t.integer "target_id"
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "action", limit: 2, null: false
     t.string "target_type"
   end
@@ -576,8 +576,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
   create_table "gpg_keys", force: :cascade do |t|
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "user_id"
     t.binary "primary_keyid"
     t.binary "fingerprint"
@@ -589,8 +589,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
   add_index "gpg_keys", ["user_id"], name: "index_gpg_keys_on_user_id", using: :btree
 
   create_table "gpg_signatures", force: :cascade do |t|
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "project_id"
     t.integer "gpg_key_id"
     t.binary "commit_sha"
@@ -789,8 +789,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
   add_index "members", ["user_id"], name: "index_members_on_user_id", using: :btree
 
   create_table "merge_request_diff_commits", id: false, force: :cascade do |t|
-    t.datetime_with_timezone "authored_date"
-    t.datetime_with_timezone "committed_date"
+    t.datetime "authored_date"
+    t.datetime "committed_date"
     t.integer "merge_request_diff_id", null: false
     t.integer "relative_order", null: false
     t.binary "sha", null: false
@@ -1114,8 +1114,8 @@ ActiveRecord::Schema.define(version: 20170905112933) do
 
   create_table "project_auto_devops", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.boolean "enabled"
     t.string "domain"
   end
-- 
cgit v1.2.1


From 17e943837d29b155878703fe0c52267a443693bb Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 13:32:14 +0100
Subject: Fix md_preview

---
 app/views/projects/_md_preview.html.haml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/views/projects/_md_preview.html.haml b/app/views/projects/_md_preview.html.haml
index d56a2b58955..119a8279d89 100644
--- a/app/views/projects/_md_preview.html.haml
+++ b/app/views/projects/_md_preview.html.haml
@@ -1,11 +1,11 @@
 - referenced_users = local_assigns.fetch(:referenced_users, nil)
 
 - if defined?(@merge_request) && @merge_request.discussion_locked?
-.issuable-note-warning
-  = icon('lock')
-  %span
-    = _('This merge request is locked.')
-    = _('Only project members can comment.')
+  .issuable-note-warning
+    = icon('lock')
+    %span
+      = _('This merge request is locked.')
+      = _('Only project members can comment.')
 
 .md-area
   .md-header
-- 
cgit v1.2.1


From 04793ff1eb5b26ebc79f3b9a6f1712d728bb17c3 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 14:22:18 +0100
Subject: Expose discussion_locked for issue_entity

---
 app/serializers/issue_entity.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/serializers/issue_entity.rb b/app/serializers/issue_entity.rb
index 0d6feb78173..aa896b40d28 100644
--- a/app/serializers/issue_entity.rb
+++ b/app/serializers/issue_entity.rb
@@ -3,6 +3,7 @@ class IssueEntity < IssuableEntity
 
   expose :branch_name
   expose :confidential
+  expose :discussion_locked
   expose :assignees, using: API::Entities::UserBasic
   expose :due_date
   expose :moved_to_id
-- 
cgit v1.2.1


From 09a4030cab281f588a1e8252ec93484e26a1be16 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 14:22:32 +0100
Subject: Remove discussionlock call

---
 app/assets/javascripts/init_issuable_sidebar.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/assets/javascripts/init_issuable_sidebar.js b/app/assets/javascripts/init_issuable_sidebar.js
index 8857601f530..29e3d2ea94e 100644
--- a/app/assets/javascripts/init_issuable_sidebar.js
+++ b/app/assets/javascripts/init_issuable_sidebar.js
@@ -13,7 +13,6 @@ export default () => {
   new LabelsSelect();
   new IssuableContext(sidebarOptions.currentUser);
   gl.Subscription.bindAll('.subscription');
-  gl.DiscussionLock.bindAll('.discussion-lock');
   new gl.DueDateSelectors();
   window.sidebar = new Sidebar();
 };
-- 
cgit v1.2.1


From e0e153d2d73199a16e7e7dbc1b34cfeabbc26410 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Thu, 14 Sep 2017 14:35:57 +0100
Subject: Dont allow diff commenting if MR locked

---
 app/assets/javascripts/diff.js                   | 3 ++-
 app/views/projects/merge_requests/show.html.haml | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/diff.js b/app/assets/javascripts/diff.js
index 6a008112203..c12dc7bdc2c 100644
--- a/app/assets/javascripts/diff.js
+++ b/app/assets/javascripts/diff.js
@@ -17,7 +17,8 @@ class Diff {
       }
     });
 
-    FilesCommentButton.init($diffFile);
+    const tab = document.getElementById('diffs');
+    if (tab && tab.dataset.isLocked === 'false') FilesCommentButton.init($diffFile);
 
     $diffFile.each((index, file) => new gl.ImageFile(file));
 
diff --git a/app/views/projects/merge_requests/show.html.haml b/app/views/projects/merge_requests/show.html.haml
index c2d16f7e731..4b2ffe4c3ae 100644
--- a/app/views/projects/merge_requests/show.html.haml
+++ b/app/views/projects/merge_requests/show.html.haml
@@ -80,7 +80,7 @@
       #pipelines.pipelines.tab-pane
         - if @pipelines.any?
           = render 'projects/commit/pipelines_list', disable_initialization: true, endpoint: pipelines_project_merge_request_path(@project, @merge_request)
-      #diffs.diffs.tab-pane
+      #diffs.diffs.tab-pane{ data: { "is-locked" => @merge_request.discussion_locked?.to_s } }
         -# This tab is always loaded via AJAX
 
     .mr-loading-status
-- 
cgit v1.2.1


From 6d59795ebbe51c99317ead0be62591a5f0926c92 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Fri, 15 Sep 2017 10:19:43 +0100
Subject: Review changes

---
 app/assets/javascripts/diff.js                     |  2 +-
 .../sidebar/components/lock/edit_form.vue          | 36 ++++++++++------------
 .../sidebar/components/lock/edit_form_buttons.vue  |  4 +--
 app/assets/stylesheets/pages/note_form.scss        |  4 +--
 app/views/projects/merge_requests/show.html.haml   |  2 +-
 changelogs/unreleased/18608-lock-issues.yml        |  2 +-
 .../sidebar/lock/lock_issue_sidebar_spec.js        |  4 +--
 .../components/issue/issue_warning_spec.js         |  1 +
 8 files changed, 26 insertions(+), 29 deletions(-)

diff --git a/app/assets/javascripts/diff.js b/app/assets/javascripts/diff.js
index c12dc7bdc2c..baeec130579 100644
--- a/app/assets/javascripts/diff.js
+++ b/app/assets/javascripts/diff.js
@@ -18,7 +18,7 @@ class Diff {
     });
 
     const tab = document.getElementById('diffs');
-    if (tab && tab.dataset.isLocked === 'false') FilesCommentButton.init($diffFile);
+    if (tab && !Object.hasOwnProperty.call(tab.dataset, 'isLocked')) FilesCommentButton.init($diffFile);
 
     $diffFile.each((index, file) => new gl.ImageFile(file));
 
diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form.vue b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
index 616abec4d5e..b79d357d4bb 100644
--- a/app/assets/javascripts/sidebar/components/lock/edit_form.vue
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
@@ -38,25 +38,23 @@ export default {
 <template>
   <div class="dropdown open">
     <div class="dropdown-menu sidebar-item-warning-message">
-      <div>
-        <p v-if="isLocked">
-          {{ __(`Unlock this ${issuableDisplayName(issuableType)}?`) }}
-          <strong>{{ __('Everyone') }}</strong>
-          {{ __('will be able to comment.') }}
-        </p>
-
-        <p v-else>
-          {{ __(`Lock this ${issuableDisplayName(issuableType)}? Only`) }}
-          <strong>{{ __('project members') }}</strong>
-          {{ __('will be able to comment.') }}
-        </p>
-
-        <edit-form-buttons
-          :is-locked="isLocked"
-          :toggle-form="toggleForm"
-          :update-locked-attribute="updateLockedAttribute"
-        />
-      </div>
+      <p class="text" v-if="isLocked">
+        {{ __(`Unlock this ${issuableDisplayName(issuableType)}?`) }}
+        <strong>{{ __('Everyone') }}</strong>
+        {{ __('will be able to comment.') }}
+      </p>
+
+      <p class="text" v-else>
+        {{ __(`Lock this ${issuableDisplayName(issuableType)}? Only`) }}
+        <strong>{{ __('project members') }}</strong>
+        {{ __('will be able to comment.') }}
+      </p>
+
+      <edit-form-buttons
+        :is-locked="isLocked"
+        :toggle-form="toggleForm"
+        :update-locked-attribute="updateLockedAttribute"
+      />
     </div>
   </div>
 </template>
diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue b/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
index 7d883704142..c3a553a7605 100644
--- a/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form_buttons.vue
@@ -22,7 +22,7 @@ export default {
       return this.isLocked ? this.__('Unlock') : this.__('Lock');
     },
 
-    updateLockedBool() {
+    toggleLock() {
       return !this.isLocked;
     },
   },
@@ -42,7 +42,7 @@ export default {
     <button
       type="button"
       class="btn btn-close"
-      @click.prevent="updateLockedAttribute(updateLockedBool)"
+      @click.prevent="updateLockedAttribute(toggleLock)"
     >
       {{ buttonText }}
     </button>
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index c2904ce2273..d1cfc75743e 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -122,14 +122,14 @@
   line-height: 1.5;
   padding: 16px;
 
-  p {
+  .text {
     color: $text-color;
   }
 
   .sidebar-item-warning-message-actions {
     display: flex;
 
-    button {
+    .btn {
       flex-grow: 1;
     }
   }
diff --git a/app/views/projects/merge_requests/show.html.haml b/app/views/projects/merge_requests/show.html.haml
index 4b2ffe4c3ae..607892a42fd 100644
--- a/app/views/projects/merge_requests/show.html.haml
+++ b/app/views/projects/merge_requests/show.html.haml
@@ -80,7 +80,7 @@
       #pipelines.pipelines.tab-pane
         - if @pipelines.any?
           = render 'projects/commit/pipelines_list', disable_initialization: true, endpoint: pipelines_project_merge_request_path(@project, @merge_request)
-      #diffs.diffs.tab-pane{ data: { "is-locked" => @merge_request.discussion_locked?.to_s } }
+      #diffs.diffs.tab-pane{ data: { "is-locked" => @merge_request.discussion_locked? } }
         -# This tab is always loaded via AJAX
 
     .mr-loading-status
diff --git a/changelogs/unreleased/18608-lock-issues.yml b/changelogs/unreleased/18608-lock-issues.yml
index 6c0ae7cebf5..0f22fe691e3 100644
--- a/changelogs/unreleased/18608-lock-issues.yml
+++ b/changelogs/unreleased/18608-lock-issues.yml
@@ -1,5 +1,5 @@
 ---
-title: Create system notes for MR too, improve doc + clean up code
+title: Add lock feature to issue and merge request sidebar
 merge_request:
 author:
 type: added
diff --git a/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
index 2848be62819..696fca516bc 100644
--- a/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
+++ b/spec/javascripts/sidebar/lock/lock_issue_sidebar_spec.js
@@ -10,9 +10,7 @@ describe('LockIssueSidebar', () => {
 
     const mediator = {
       service: {
-        update: () => new Promise((resolve) => {
-          resolve(true);
-        }),
+        update: Promise.resolve(true),
       },
 
       store: {
diff --git a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
index c366589ec50..a5f408d3165 100644
--- a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
+++ b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
@@ -5,6 +5,7 @@ import mountComponent from '../../../helpers/vue_mount_component_helper';
 const IssueWarning = Vue.extend(issueWarning);
 
 function formatWarning(string) {
+  // Replace newlines with a space then replace multiple spaces with one space
   return string.trim().replace(/\n/g, ' ').replace(/\s\s+/g, ' ');
 }
 
-- 
cgit v1.2.1


From 1b52d8a4832f0231fa3f6c5cb28d065bbea9ba94 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Fri, 15 Sep 2017 17:40:29 +0100
Subject: Fix static analysis

---
 app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue | 2 +-
 app/assets/stylesheets/pages/note_form.scss                           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
index c24edf6154d..a6a39207648 100644
--- a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -57,7 +57,7 @@ export default {
         discussion_locked: locked,
       })
       .then(() => location.reload())
-      .catch(() => Flash(this.__(`Something went wrong trying to change the locked state of this ${issuableDisplayName(this.issuableType)}`)));
+      .catch(() => Flash(this.__(`Something went wrong trying to change the locked state of this ${this.issuableDisplayName(this.issuableType)}`)));
     },
   },
 };
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index d1cfc75743e..8b7d42214e6 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -1,7 +1,7 @@
 /**
  * Note Form
  */
- .comment-btn {
+.comment-btn {
   @extend .btn-create;
 }
 
-- 
cgit v1.2.1


From 87de569aabd2274427ae8d0c2168f8bbf8643da7 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Mon, 18 Sep 2017 12:15:00 +0100
Subject: Fix task_lists_spec

---
 app/views/projects/issues/show.html.haml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/views/projects/issues/show.html.haml b/app/views/projects/issues/show.html.haml
index b8dcd654739..b9fec8af4d7 100644
--- a/app/views/projects/issues/show.html.haml
+++ b/app/views/projects/issues/show.html.haml
@@ -30,6 +30,7 @@
         = icon('eye-slash', class: 'issuable-warning-icon')
       - if @issue.discussion_locked?
         = icon('lock', class: 'issuable-warning-icon')
+      = issuable_meta(@issue, @project, "Issue")
 
   .issuable-actions.js-issuable-actions
     .clearfix.issue-btn-group.dropdown
-- 
cgit v1.2.1


From 55a7529621515eaeffa1424a281e639cf74be6cf Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 20 Sep 2017 10:28:14 +0100
Subject: is-active review changes

---
 .../components/confidential/confidential_issue_sidebar.vue  |  4 ++--
 .../sidebar/components/lock/lock_issue_sidebar.vue          |  4 ++--
 app/assets/stylesheets/pages/issuable.scss                  | 13 +++++--------
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
index dfdd00cff47..f2b1099a678 100644
--- a/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/confidential_issue_sidebar.vue
@@ -70,11 +70,11 @@ export default {
         :update-confidential-attribute="updateConfidentialAttribute"
       />
       <div v-if="!isConfidential" class="no-value sidebar-item-value">
-        <i class="fa fa-eye not-active"></i>
+        <i class="fa fa-eye sidebar-item-icon"></i>
         Not confidential
       </div>
       <div v-else class="value sidebar-item-value hide-collapsed">
-        <i aria-hidden="true" class="fa fa-eye-slash is-active"></i>
+        <i aria-hidden="true" class="fa fa-eye-slash sidebar-item-icon is-active"></i>
         This issue is confidential
       </div>
     </div>
diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
index a6a39207648..9021d17dddf 100644
--- a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -95,12 +95,12 @@ export default {
       />
 
       <div v-if="isLocked" class="value sidebar-item-value">
-        <i aria-hidden="true" class="fa fa-lock is-active"></i>
+        <i aria-hidden="true" class="fa fa-lock sidebar-item-icon is-active"></i>
         {{ __('Locked') }}
       </div>
 
       <div v-else class="no-value sidebar-item-value hide-collapsed">
-        <i aria-hidden="true" class="fa fa-unlock not-active"></i>
+        <i aria-hidden="true" class="fa fa-unlock sidebar-item-icon"></i>
         {{ __('Unlocked') }}
       </div>
     </div>
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index e0083be7be9..a88484d1a9e 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -16,15 +16,12 @@
   text-align: center;
 }
 
-.issuable-sidebar-item {
-  .not-active,
-  .is-active {
-    border-radius: $border-radius-default;
-    padding: 5px;
-    margin: 0 3px 0 -4px;
-  }
+.sidebar-item-icon {
+  border-radius: $border-radius-default;
+  padding: 5px;
+  margin: 0 3px 0 -4px;
 
-  .is-active {
+  &.is-active {
     color: $orange-600;
     background-color: $orange-50;
   }
-- 
cgit v1.2.1


From fea7b9e68255771a308e9d391079d83c58340814 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 20 Sep 2017 15:40:29 +0100
Subject: Fix diff commenting on commits

---
 app/assets/javascripts/diff.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/diff.js b/app/assets/javascripts/diff.js
index baeec130579..8959365a5c9 100644
--- a/app/assets/javascripts/diff.js
+++ b/app/assets/javascripts/diff.js
@@ -18,7 +18,7 @@ class Diff {
     });
 
     const tab = document.getElementById('diffs');
-    if (tab && !Object.hasOwnProperty.call(tab.dataset, 'isLocked')) FilesCommentButton.init($diffFile);
+    if (!tab || (tab && !Object.hasOwnProperty.call(tab.dataset, 'isLocked'))) FilesCommentButton.init($diffFile);
 
     $diffFile.each((index, file) => new gl.ImageFile(file));
 
-- 
cgit v1.2.1


From d4fa672c20657a1c7d2fcfa25e9798e7ccdbf39d Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 25 Sep 2017 16:10:25 +0900
Subject: Create Kubernetes cluster on GKE from k8s service

---
 .../google_api/authorizations_controller.rb        |  27 ++++++
 app/controllers/projects/clusters_controller.rb    | 102 +++++++++++++++++++++
 app/models/ci/cluster.rb                           |  14 +++
 app/models/project.rb                              |   1 +
 app/views/projects/clusters/edit.html.haml         |   2 +
 app/views/projects/clusters/new.html.haml          |  17 ++++
 config/routes.rb                                   |   1 +
 config/routes/google_api.rb                        |   5 +
 config/routes/project.rb                           |   7 ++
 db/migrate/20170924094327_create_ci_clusters.rb    |  29 ++++++
 db/schema.rb                                       |  68 +++++++++-----
 lib/google_api/authentication.rb                   |  51 +++++++++++
 lib/google_api/cloud_platform/client.rb            |  24 +++++
 13 files changed, 323 insertions(+), 25 deletions(-)
 create mode 100644 app/controllers/google_api/authorizations_controller.rb
 create mode 100644 app/controllers/projects/clusters_controller.rb
 create mode 100644 app/models/ci/cluster.rb
 create mode 100644 app/views/projects/clusters/edit.html.haml
 create mode 100644 app/views/projects/clusters/new.html.haml
 create mode 100644 config/routes/google_api.rb
 create mode 100644 db/migrate/20170924094327_create_ci_clusters.rb
 create mode 100644 lib/google_api/authentication.rb
 create mode 100644 lib/google_api/cloud_platform/client.rb

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
new file mode 100644
index 00000000000..e99c38025b8
--- /dev/null
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -0,0 +1,27 @@
+module GoogleApi
+  class AuthorizationsController < ApplicationController
+    # callback_google_api_authorizations GET|POST /google_api/authorizations/callback(.:format)                                                        google_api/authorizations#callback
+    ##
+    # TODO: 
+    # - Is it ok to use both "http://localhost:3000/google_api/authorizations/callback"(For login) and "http://localhost:3000/google_api/authorizations/callback"(For API token)
+    def callback
+      session[access_token_key] = api_client.get_token(params[:code])
+
+      if params[:state]
+        redirect_to params[:state]
+      else
+        redirect_to root_url
+      end
+    end
+
+    def api_client
+      @api_client ||=
+        GoogleApi::Authentication.new(nil, callback_google_api_authorizations_url)
+    end
+
+    def access_token_key
+      # :"#{api_client.scope}_access_token"
+      :"hoge_access_token" # TODO: 
+    end
+  end
+end
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
new file mode 100644
index 00000000000..5c9319f661a
--- /dev/null
+++ b/app/controllers/projects/clusters_controller.rb
@@ -0,0 +1,102 @@
+class Projects::ClustersController < Projects::ApplicationController
+  # before_action :authenticate_google_api
+  before_action :cluster
+
+  # before_action :authorize_admin_clusters! # TODO: Authentication
+
+  def index
+    if cluster
+      redirect_to action: 'edit'
+    else
+      redirect_to action: 'new'
+    end
+  end
+
+  ##
+  # TODO: 
+  # - Show form for "Create on Google Container Engine"
+  # - Show form for "Use existing kubernets cluster"
+  # - If user has not authroized yet, Show "Sign in with Google" button
+  # - If user has already authroized, Skip "Sign in with Google" button
+  # - user.is_authenticated_for_gcp?
+  # - user.authenticate_for_gcp!
+  # - Create this module which can be used from view
+  def new
+    unless session[access_token_key]
+      @authorize_url = api_client.authorize_url
+    end
+  end
+
+  ##
+  # TODO: 
+  # - If create on GKE, Use Google::Apis::ContainerV1::ContainerService
+  # - If create manually, save in db (Prob, Project > Setting)
+  # - Dry up with Service
+  def create
+    redirect_to action: 'index'
+  end
+
+  # TODO: Show results/status. Edits Swtich for enable/disable.
+  # If created with GKE, non-editable form. enable/disable switch.
+  # If created manually, editable form. enable/disable switch.
+  # GKE params are   on-off swtich
+  # Manul params are on-off swtich, Endpoint, CACert, k8s Token, Proj namespace.
+  def edit
+    unless session[access_token_key]
+      @authorize_url = api_client.authorize_url
+    end
+  end
+
+  def update
+    cluster.update(schedule_params)
+    render :edit
+  end
+
+  # In presenter
+  # TODO: Generate a link to the cluster on GKE
+
+  def gcp_projects
+    # api_client.blah
+    # TODO: Return all avaiable GCP Projects.
+    # TODO: Return json
+    # TODO: Dry with concern
+  end
+
+  def gke_zones
+    # api_client.blah
+    # TODO: Return all avaiable zones on GKE.
+    # TODO: Return json
+    # TODO: Dry with concern
+  end
+
+  private
+
+  # def authenticate_google_api
+  #   if cluster&.on_gke? && session[access_token_key].blank?
+  #     redirect_to api_client.authorize_url(callback_import_url)
+  #   end
+  # end
+
+  def cluster
+    # Each project has only one cluster, for now. In the future iteraiton, we'll support multiple clusters
+    @cluster ||= project.clusters.first
+  end
+
+  def cluster_params
+    params.require(:cluster).permit(:aaa)
+  end
+
+  def api_client
+    @api_client ||=
+      GoogleApi::CloudPlatform::Client.new(
+        session[access_token_key],
+        callback_google_api_authorizations_url,
+        state: namespace_project_clusters_url.to_s
+      )
+  end
+
+  def access_token_key
+    # :"#{api_client.scope}_access_token"
+    :"hoge_access_token" # TODO: 
+  end
+end
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
new file mode 100644
index 00000000000..2e614a1a373
--- /dev/null
+++ b/app/models/ci/cluster.rb
@@ -0,0 +1,14 @@
+module Ci
+  class Cluster < ActiveRecord::Base
+    extend Gitlab::Ci::Model
+
+    belongs_to :project
+    belongs_to :owner, class_name: 'User'
+
+    enum creation_type: {
+      unknown: nil,
+      on_gke: 1,
+      manual: 2
+    }    
+  end
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index f7221e4f3b2..6b896746864 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -171,6 +171,7 @@ class Project < ActiveRecord::Base
 
   has_many :commit_statuses
   has_many :pipelines, class_name: 'Ci::Pipeline'
+  has_many :clusters, class_name: 'Ci::Cluster'
 
   # Ci::Build objects store data on the file system such as artifact files and
   # build traces. Currently there's no efficient way of removing this data in
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
new file mode 100644
index 00000000000..6445b3ee75d
--- /dev/null
+++ b/app/views/projects/clusters/edit.html.haml
@@ -0,0 +1,2 @@
+edit/show cluster
+= @cluster.inspect
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
new file mode 100644
index 00000000000..5e291d07835
--- /dev/null
+++ b/app/views/projects/clusters/new.html.haml
@@ -0,0 +1,17 @@
+Create a new cluster
+
+%br
+
+- if @authorize_url
+  I have not authenticated yet. I can authenticate from
+  = link_to("authenticate from here", @authorize_url)
+- else
+  I have already authenticated.
+  %br
+  Avaiable GCP project lists
+  %br
+  Avaiable zones
+  %br
+  = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, param1: 'value1', param2: 'value2'), method: :post
+  = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, param1: 'value1', param2: 'value2'), method: :post
+
diff --git a/config/routes.rb b/config/routes.rb
index 5683725c8a2..405bfcc2d8e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -87,6 +87,7 @@ Rails.application.routes.draw do
     resources :issues, module: :boards, only: [:index, :update]
   end
 
+  draw :google_api
   draw :import
   draw :uploads
   draw :explore
diff --git a/config/routes/google_api.rb b/config/routes/google_api.rb
new file mode 100644
index 00000000000..57e15d0d39c
--- /dev/null
+++ b/config/routes/google_api.rb
@@ -0,0 +1,5 @@
+namespace :google_api do
+  resource :authorizations, only: [], controller: :authorizations do
+    match :callback, via: [:get, :post]
+  end
+end
diff --git a/config/routes/project.rb b/config/routes/project.rb
index b36d13888cd..5a43e2274a6 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -183,6 +183,13 @@ constraints(ProjectUrlConstrainer.new) do
         end
       end
 
+      resources :clusters, except: [:show, :destroy] do
+        collection do
+          get :gcp_projects # TODO: This doesn't belong here. Grape or under user. Hint. Serilizer
+          get :gke_zones
+        end
+      end
+
       resources :environments, except: [:destroy] do
         member do
           post :stop
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
new file mode 100644
index 00000000000..86e75edf203
--- /dev/null
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -0,0 +1,29 @@
+class CreateCiClusters < ActiveRecord::Migration
+  DOWNTIME = false
+
+  def change
+    create_table :ci_clusters do |t|
+      t.integer :project_id
+      t.integer :owner_id
+      t.datetime_with_timezone :created_at, null: false
+      t.datetime_with_timezone :updated_at, null: false
+      t.boolean :enabled, default: true
+      t.string :end_point
+      t.text :ca_cert # Base64?
+      t.string :token
+      t.string :username
+      t.string :password
+      t.string :project_namespace
+      t.integer :creation_type # manual or on_gke
+    end
+
+    # TODO: fk, index, encypt
+
+    add_foreign_key :ci_clusters, :projects
+    add_foreign_key :ci_clusters, :users, column: :owner_id
+  end
+
+  def down
+    drop_table :ci_clusters
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 80ef91ec95d..5258adcbcb7 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170921115009) do
+ActiveRecord::Schema.define(version: 20170924094327) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -32,8 +32,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.text "description", null: false
     t.string "header_logo"
     t.string "logo"
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.text "description_html"
     t.integer "cached_markdown_version"
   end
@@ -101,10 +101,6 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.text "help_page_text_html"
     t.text "shared_runners_text_html"
     t.text "after_sign_up_text_html"
-    t.integer "rsa_key_restriction", default: 0, null: false
-    t.integer "dsa_key_restriction", default: 0, null: false
-    t.integer "ecdsa_key_restriction", default: 0, null: false
-    t.integer "ed25519_key_restriction", default: 0, null: false
     t.boolean "housekeeping_enabled", default: true, null: false
     t.boolean "housekeeping_bitmaps_enabled", default: true, null: false
     t.integer "housekeeping_incremental_repack_period", default: 10, null: false
@@ -132,6 +128,10 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.boolean "password_authentication_enabled"
     t.integer "performance_bar_allowed_group_id"
     t.boolean "hashed_storage_enabled", default: false, null: false
+    t.integer "rsa_key_restriction", default: 0, null: false
+    t.integer "dsa_key_restriction", default: 0, null: false
+    t.integer "ecdsa_key_restriction", default: 0, null: false
+    t.integer "ed25519_key_restriction", default: 0, null: false
     t.boolean "project_export_enabled", default: true, null: false
     t.boolean "auto_devops_enabled", default: false, null: false
   end
@@ -256,7 +256,6 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_index "ci_builds", ["commit_id", "status", "type"], name: "index_ci_builds_on_commit_id_and_status_and_type", using: :btree
   add_index "ci_builds", ["commit_id", "type", "name", "ref"], name: "index_ci_builds_on_commit_id_and_type_and_name_and_ref", using: :btree
   add_index "ci_builds", ["commit_id", "type", "ref"], name: "index_ci_builds_on_commit_id_and_type_and_ref", using: :btree
-  add_index "ci_builds", ["id"], name: "index_for_ci_builds_retried_migration", where: "(retried IS NULL)", using: :btree
   add_index "ci_builds", ["project_id"], name: "index_ci_builds_on_project_id", using: :btree
   add_index "ci_builds", ["protected"], name: "index_ci_builds_on_protected", using: :btree
   add_index "ci_builds", ["runner_id"], name: "index_ci_builds_on_runner_id", using: :btree
@@ -267,6 +266,21 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_index "ci_builds", ["updated_at"], name: "index_ci_builds_on_updated_at", using: :btree
   add_index "ci_builds", ["user_id"], name: "index_ci_builds_on_user_id", using: :btree
 
+  create_table "ci_clusters", force: :cascade do |t|
+    t.integer "project_id"
+    t.integer "owner_id"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.boolean "enabled", default: true
+    t.string "end_point"
+    t.text "ca_cert"
+    t.string "token"
+    t.string "username"
+    t.string "password"
+    t.string "project_namespace"
+    t.integer "creation_type"
+  end
+
   create_table "ci_group_variables", force: :cascade do |t|
     t.string "key", null: false
     t.text "value"
@@ -275,8 +289,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.string "encrypted_value_iv"
     t.integer "group_id", null: false
     t.boolean "protected", default: false, null: false
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
   end
 
   add_index "ci_group_variables", ["group_id", "key"], name: "index_ci_group_variables_on_group_id_and_key", unique: true, using: :btree
@@ -288,8 +302,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.string "encrypted_value_salt"
     t.string "encrypted_value_iv"
     t.integer "pipeline_schedule_id", null: false
-    t.datetime_with_timezone "created_at"
-    t.datetime_with_timezone "updated_at"
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "ci_pipeline_schedule_variables", ["pipeline_schedule_id", "key"], name: "index_ci_pipeline_schedule_variables_on_schedule_id_and_key", unique: true, using: :btree
@@ -341,12 +355,14 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.integer "auto_canceled_by_id"
     t.integer "pipeline_schedule_id"
     t.integer "source"
-    t.integer "config_source"
     t.boolean "protected"
+    t.integer "iid"
+    t.integer "config_source"
   end
 
   add_index "ci_pipelines", ["auto_canceled_by_id"], name: "index_ci_pipelines_on_auto_canceled_by_id", using: :btree
   add_index "ci_pipelines", ["pipeline_schedule_id"], name: "index_ci_pipelines_on_pipeline_schedule_id", using: :btree
+  add_index "ci_pipelines", ["project_id", "iid"], name: "index_ci_pipelines_on_project_id_and_iid", unique: true, using: :btree
   add_index "ci_pipelines", ["project_id", "ref", "status"], name: "index_ci_pipelines_on_project_id_and_ref_and_status", using: :btree
   add_index "ci_pipelines", ["project_id", "sha"], name: "index_ci_pipelines_on_project_id_and_sha", using: :btree
   add_index "ci_pipelines", ["project_id"], name: "index_ci_pipelines_on_project_id", using: :btree
@@ -538,8 +554,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.integer "project_id"
     t.integer "author_id", null: false
     t.integer "target_id"
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "action", limit: 2, null: false
     t.string "target_type"
   end
@@ -577,8 +593,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
   create_table "gpg_keys", force: :cascade do |t|
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "user_id"
     t.binary "primary_keyid"
     t.binary "fingerprint"
@@ -590,8 +606,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_index "gpg_keys", ["user_id"], name: "index_gpg_keys_on_user_id", using: :btree
 
   create_table "gpg_signatures", force: :cascade do |t|
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.integer "project_id"
     t.integer "gpg_key_id"
     t.binary "commit_sha"
@@ -789,8 +805,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_index "members", ["user_id"], name: "index_members_on_user_id", using: :btree
 
   create_table "merge_request_diff_commits", id: false, force: :cascade do |t|
-    t.datetime_with_timezone "authored_date"
-    t.datetime_with_timezone "committed_date"
+    t.datetime "authored_date"
+    t.datetime "committed_date"
     t.integer "merge_request_diff_id", null: false
     t.integer "relative_order", null: false
     t.binary "sha", null: false
@@ -1113,8 +1129,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
 
   create_table "project_auto_devops", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.boolean "enabled"
     t.string "domain"
   end
@@ -1204,7 +1220,6 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.string "repository_storage", default: "default", null: false
     t.boolean "request_access_enabled", default: false, null: false
     t.boolean "has_external_wiki"
-    t.string "ci_config_path"
     t.boolean "lfs_enabled"
     t.text "description_html"
     t.boolean "only_allow_merge_if_all_discussions_are_resolved"
@@ -1212,8 +1227,9 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.integer "auto_cancel_pending_pipelines", default: 1, null: false
     t.string "import_jid"
     t.integer "cached_markdown_version"
-    t.text "delete_error"
     t.datetime "last_repository_updated_at"
+    t.string "ci_config_path"
+    t.text "delete_error"
     t.integer "storage_version", limit: 2
     t.boolean "resolve_outdated_diff_discussions"
   end
@@ -1685,6 +1701,8 @@ ActiveRecord::Schema.define(version: 20170921115009) do
   add_foreign_key "ci_builds", "ci_pipelines", column: "auto_canceled_by_id", name: "fk_a2141b1522", on_delete: :nullify
   add_foreign_key "ci_builds", "ci_stages", column: "stage_id", name: "fk_3a9eaa254d", on_delete: :cascade
   add_foreign_key "ci_builds", "projects", name: "fk_befce0568a", on_delete: :cascade
+  add_foreign_key "ci_clusters", "projects"
+  add_foreign_key "ci_clusters", "users", column: "owner_id"
   add_foreign_key "ci_group_variables", "namespaces", column: "group_id", name: "fk_33ae4d58d8", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedule_variables", "ci_pipeline_schedules", column: "pipeline_schedule_id", name: "fk_41c35fda51", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedules", "projects", name: "fk_8ead60fcc4", on_delete: :cascade
diff --git a/lib/google_api/authentication.rb b/lib/google_api/authentication.rb
new file mode 100644
index 00000000000..d7b473525fb
--- /dev/null
+++ b/lib/google_api/authentication.rb
@@ -0,0 +1,51 @@
+module GoogleApi
+  class Authentication
+    attr_reader :access_token, :redirect_uri, :state
+
+    def initialize(access_token, redirect_uri, state: nil)
+      @access_token = access_token
+      @redirect_uri = redirect_uri
+      @state = state
+    end
+
+    def client
+      return @client if defined?(@client)
+
+      unless config
+        raise 'OAuth configuration for google_oauth2 missing.'
+      end
+
+      @client = ::OAuth2::Client.new(
+        config.app_id,
+        config.app_secret,
+        site: 'https://accounts.google.com',
+        token_url: '/o/oauth2/token', 
+        authorize_url: '/o/oauth2/auth'
+      )
+    end
+
+    def authorize_url
+      client.auth_code.authorize_url(
+        redirect_uri: redirect_uri,
+        scope: scope,
+        state: state # This is used for arbitary redirection
+      )
+    end
+
+    def get_token(code)
+      client.auth_code.get_token(code, redirect_uri: redirect_uri).token
+    end
+
+    protected
+
+    def scope
+      raise NotImplementedError
+    end
+
+    private
+
+    def config
+      Gitlab.config.omniauth.providers.find { |provider| provider.name == "google_oauth2" }
+    end
+  end
+end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
new file mode 100644
index 00000000000..2c2aefc542c
--- /dev/null
+++ b/lib/google_api/cloud_platform/client.rb
@@ -0,0 +1,24 @@
+module GoogleApi
+  module CloudPlatform
+    class Client < GoogleApi::Authentication
+      # Google::Apis::ContainerV1::ContainerService.new
+      def scope
+        'https://www.googleapis.com/auth/cloud-platform'
+      end
+
+      def projects_zones_clusters_get
+        # TODO: 
+        # service = Google::Apis::ContainerV1::ContainerService.new
+        # service.authorization = access_token
+        # project_id = params['project_id']
+        # ...
+        # response = service.list_zone_clusters(project_id, zone)
+        response
+      end
+
+      def projects_zones_clusters_create
+        # TODO
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From cf8140a752afe9a00197b11c9f9d38098717e6df Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 25 Sep 2017 16:38:21 +0900
Subject: Discard unnessecary changed in schema

---
 db/schema.rb | 49 ++++++++++++++++++++++++-------------------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/db/schema.rb b/db/schema.rb
index 5258adcbcb7..f3e174c847f 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -32,8 +32,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.text "description", null: false
     t.string "header_logo"
     t.string "logo"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.text "description_html"
     t.integer "cached_markdown_version"
   end
@@ -101,6 +101,10 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.text "help_page_text_html"
     t.text "shared_runners_text_html"
     t.text "after_sign_up_text_html"
+    t.integer "rsa_key_restriction", default: 0, null: false
+    t.integer "dsa_key_restriction", default: 0, null: false
+    t.integer "ecdsa_key_restriction", default: 0, null: false
+    t.integer "ed25519_key_restriction", default: 0, null: false
     t.boolean "housekeeping_enabled", default: true, null: false
     t.boolean "housekeeping_bitmaps_enabled", default: true, null: false
     t.integer "housekeeping_incremental_repack_period", default: 10, null: false
@@ -128,10 +132,6 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.boolean "password_authentication_enabled"
     t.integer "performance_bar_allowed_group_id"
     t.boolean "hashed_storage_enabled", default: false, null: false
-    t.integer "rsa_key_restriction", default: 0, null: false
-    t.integer "dsa_key_restriction", default: 0, null: false
-    t.integer "ecdsa_key_restriction", default: 0, null: false
-    t.integer "ed25519_key_restriction", default: 0, null: false
     t.boolean "project_export_enabled", default: true, null: false
     t.boolean "auto_devops_enabled", default: false, null: false
   end
@@ -256,6 +256,7 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_index "ci_builds", ["commit_id", "status", "type"], name: "index_ci_builds_on_commit_id_and_status_and_type", using: :btree
   add_index "ci_builds", ["commit_id", "type", "name", "ref"], name: "index_ci_builds_on_commit_id_and_type_and_name_and_ref", using: :btree
   add_index "ci_builds", ["commit_id", "type", "ref"], name: "index_ci_builds_on_commit_id_and_type_and_ref", using: :btree
+  add_index "ci_builds", ["id"], name: "index_for_ci_builds_retried_migration", where: "(retried IS NULL)", using: :btree
   add_index "ci_builds", ["project_id"], name: "index_ci_builds_on_project_id", using: :btree
   add_index "ci_builds", ["protected"], name: "index_ci_builds_on_protected", using: :btree
   add_index "ci_builds", ["runner_id"], name: "index_ci_builds_on_runner_id", using: :btree
@@ -289,8 +290,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.string "encrypted_value_iv"
     t.integer "group_id", null: false
     t.boolean "protected", default: false, null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
   end
 
   add_index "ci_group_variables", ["group_id", "key"], name: "index_ci_group_variables_on_group_id_and_key", unique: true, using: :btree
@@ -302,8 +303,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.string "encrypted_value_salt"
     t.string "encrypted_value_iv"
     t.integer "pipeline_schedule_id", null: false
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime_with_timezone "created_at"
+    t.datetime_with_timezone "updated_at"
   end
 
   add_index "ci_pipeline_schedule_variables", ["pipeline_schedule_id", "key"], name: "index_ci_pipeline_schedule_variables_on_schedule_id_and_key", unique: true, using: :btree
@@ -355,14 +356,12 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.integer "auto_canceled_by_id"
     t.integer "pipeline_schedule_id"
     t.integer "source"
-    t.boolean "protected"
-    t.integer "iid"
     t.integer "config_source"
+    t.boolean "protected"
   end
 
   add_index "ci_pipelines", ["auto_canceled_by_id"], name: "index_ci_pipelines_on_auto_canceled_by_id", using: :btree
   add_index "ci_pipelines", ["pipeline_schedule_id"], name: "index_ci_pipelines_on_pipeline_schedule_id", using: :btree
-  add_index "ci_pipelines", ["project_id", "iid"], name: "index_ci_pipelines_on_project_id_and_iid", unique: true, using: :btree
   add_index "ci_pipelines", ["project_id", "ref", "status"], name: "index_ci_pipelines_on_project_id_and_ref_and_status", using: :btree
   add_index "ci_pipelines", ["project_id", "sha"], name: "index_ci_pipelines_on_project_id_and_sha", using: :btree
   add_index "ci_pipelines", ["project_id"], name: "index_ci_pipelines_on_project_id", using: :btree
@@ -554,8 +553,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.integer "project_id"
     t.integer "author_id", null: false
     t.integer "target_id"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "action", limit: 2, null: false
     t.string "target_type"
   end
@@ -593,8 +592,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
   create_table "gpg_keys", force: :cascade do |t|
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "user_id"
     t.binary "primary_keyid"
     t.binary "fingerprint"
@@ -606,8 +605,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_index "gpg_keys", ["user_id"], name: "index_gpg_keys_on_user_id", using: :btree
 
   create_table "gpg_signatures", force: :cascade do |t|
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "project_id"
     t.integer "gpg_key_id"
     t.binary "commit_sha"
@@ -805,8 +804,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_index "members", ["user_id"], name: "index_members_on_user_id", using: :btree
 
   create_table "merge_request_diff_commits", id: false, force: :cascade do |t|
-    t.datetime "authored_date"
-    t.datetime "committed_date"
+    t.datetime_with_timezone "authored_date"
+    t.datetime_with_timezone "committed_date"
     t.integer "merge_request_diff_id", null: false
     t.integer "relative_order", null: false
     t.binary "sha", null: false
@@ -1129,8 +1128,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
 
   create_table "project_auto_devops", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.boolean "enabled"
     t.string "domain"
   end
@@ -1220,6 +1219,7 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.string "repository_storage", default: "default", null: false
     t.boolean "request_access_enabled", default: false, null: false
     t.boolean "has_external_wiki"
+    t.string "ci_config_path"
     t.boolean "lfs_enabled"
     t.text "description_html"
     t.boolean "only_allow_merge_if_all_discussions_are_resolved"
@@ -1227,9 +1227,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.integer "auto_cancel_pending_pipelines", default: 1, null: false
     t.string "import_jid"
     t.integer "cached_markdown_version"
-    t.datetime "last_repository_updated_at"
-    t.string "ci_config_path"
     t.text "delete_error"
+    t.datetime "last_repository_updated_at"
     t.integer "storage_version", limit: 2
     t.boolean "resolve_outdated_diff_discussions"
   end
-- 
cgit v1.2.1


From bdc618c289b8c2b996a3ef92b7748966c311d28a Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 02:11:26 +0900
Subject: ok

---
 .../google_api/authorizations_controller.rb        | 20 ++------
 app/controllers/projects/clusters_controller.rb    | 59 ++++++++++++++++++----
 app/views/projects/clusters/new.html.haml          |  6 +--
 db/migrate/20170924094327_create_ci_clusters.rb    | 34 ++++++++++---
 db/schema.rb                                       | 13 +++--
 lib/google_api/cloud_platform/client.rb            | 19 ++++++-
 6 files changed, 110 insertions(+), 41 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index e99c38025b8..1fafd7e88be 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -1,11 +1,11 @@
 module GoogleApi
   class AuthorizationsController < ApplicationController
-    # callback_google_api_authorizations GET|POST /google_api/authorizations/callback(.:format)                                                        google_api/authorizations#callback
-    ##
-    # TODO: 
-    # - Is it ok to use both "http://localhost:3000/google_api/authorizations/callback"(For login) and "http://localhost:3000/google_api/authorizations/callback"(For API token)
+    # /google_api/authorizations/callback(.:format)
     def callback
-      session[access_token_key] = api_client.get_token(params[:code])
+      # TODO: Error handling
+      session[GoogleApi::CloudPlatform::Client.token_in_session] = 
+        GoogleApi::Authentication.new(nil, callback_google_api_authorizations_url)
+                                 .get_token(params[:code])
 
       if params[:state]
         redirect_to params[:state]
@@ -13,15 +13,5 @@ module GoogleApi
         redirect_to root_url
       end
     end
-
-    def api_client
-      @api_client ||=
-        GoogleApi::Authentication.new(nil, callback_google_api_authorizations_url)
-    end
-
-    def access_token_key
-      # :"#{api_client.scope}_access_token"
-      :"hoge_access_token" # TODO: 
-    end
   end
 end
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 5c9319f661a..2aafc6364eb 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -22,7 +22,7 @@ class Projects::ClustersController < Projects::ApplicationController
   # - user.authenticate_for_gcp!
   # - Create this module which can be used from view
   def new
-    unless session[access_token_key]
+    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
       @authorize_url = api_client.authorize_url
     end
   end
@@ -33,6 +33,48 @@ class Projects::ClustersController < Projects::ApplicationController
   # - If create manually, save in db (Prob, Project > Setting)
   # - Dry up with Service
   def create
+    if params['creation_type'] == 'on_gke'
+      results = api_client.projects_zones_clusters_create(
+        params['gcp_project_id'],
+        params['cluster_zone'],
+        params['cluster_name'],
+        params['cluster_size']
+      )
+
+      # TODO: How to create
+      project.kubernetes_service.save(
+        end_point: results['end_point'],
+        ca_cert: results['ca_cert'],
+        token: nil,
+        username: results['username'],
+        password: results['password'],
+        project_namespace: params['project_namespace']
+      )
+
+      project.clusters.create(
+        creation_type: params['creation_type'],
+        gcp_project_id: params['gcp_project_id'],
+        cluster_zone: params['cluster_zone'],
+        cluster_name: params['cluster_name'],
+        kubernetes_service: project.kubernetes_service
+      )
+    elsif params['creation_type'] == 'manual'
+      # TODO: Transaction
+      project.kubernetes_service.save(
+        end_point: params['end_point'],
+        ca_cert: params['ca_cert'],
+        token: params['token'],
+        username: params['username'],
+        password: params['password'],
+        project_namespace: params['project_namespace']
+      )
+
+      project.clusters.create(
+        creation_type: params['creation_type'],
+        kubernetes_service: project.kubernetes_service
+      )
+    end
+
     redirect_to action: 'index'
   end
 
@@ -42,7 +84,7 @@ class Projects::ClustersController < Projects::ApplicationController
   # GKE params are   on-off swtich
   # Manul params are on-off swtich, Endpoint, CACert, k8s Token, Proj namespace.
   def edit
-    unless session[access_token_key]
+    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
       @authorize_url = api_client.authorize_url
     end
   end
@@ -82,21 +124,16 @@ class Projects::ClustersController < Projects::ApplicationController
     @cluster ||= project.clusters.first
   end
 
-  def cluster_params
-    params.require(:cluster).permit(:aaa)
-  end
+  # def cluster_params
+  #   params.require(:cluster).permit(:aaa)
+  # end
 
   def api_client
     @api_client ||=
       GoogleApi::CloudPlatform::Client.new(
-        session[access_token_key],
+        session[GoogleApi::CloudPlatform::Client.token_in_session],
         callback_google_api_authorizations_url,
         state: namespace_project_clusters_url.to_s
       )
   end
-
-  def access_token_key
-    # :"#{api_client.scope}_access_token"
-    :"hoge_access_token" # TODO: 
-  end
 end
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index 5e291d07835..b716cc51c20 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -12,6 +12,6 @@ Create a new cluster
   %br
   Avaiable zones
   %br
-  = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, param1: 'value1', param2: 'value2'), method: :post
-  = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, param1: 'value1', param2: 'value2'), method: :post
-
+  = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: 'new-cluster-shinya', gcp_project_id: 'gitlab-internal', cluster_zone: 'gitlab-internal', cluster_size: 'gitlab-internal', project_namespace: 'aaa'), method: :post
+  %br
+  = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index 86e75edf203..7a35fe35605 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -1,26 +1,48 @@
 class CreateCiClusters < ActiveRecord::Migration
   DOWNTIME = false
 
-  def change
+  def up
     create_table :ci_clusters do |t|
       t.integer :project_id
       t.integer :owner_id
-      t.datetime_with_timezone :created_at, null: false
-      t.datetime_with_timezone :updated_at, null: false
+      t.integer :service_id
+
+      # General
       t.boolean :enabled, default: true
+      t.integer :creation_type # manual or on_gke
+
+      # k8s integration specific
+      t.string :project_namespace
+
+      # Cluster details
       t.string :end_point
-      t.text :ca_cert # Base64?
+      t.text :ca_cert
       t.string :token
       t.string :username
       t.string :password
-      t.string :project_namespace
-      t.integer :creation_type # manual or on_gke
+
+      # GKE
+      t.string :gcp_project_id
+      t.string :cluster_zone
+      t.string :cluster_name
+
+      t.datetime_with_timezone :created_at, null: false
+      t.datetime_with_timezone :updated_at, null: false
     end
 
+    # create_table :ci_gke_clusters do |t|
+    #   t.integer :ci_cluster_id
+    #   t.string :gcp_project_id
+    #   t.string :cluster_zone
+    #   t.string :cluster_name
+    # end
+    # add_foreign_key :ci_gke_clusters, :ci_clusters
+
     # TODO: fk, index, encypt
 
     add_foreign_key :ci_clusters, :projects
     add_foreign_key :ci_clusters, :users, column: :owner_id
+    add_foreign_key :ci_clusters, :services
   end
 
   def down
diff --git a/db/schema.rb b/db/schema.rb
index f3e174c847f..8000229d5fa 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -270,16 +270,20 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   create_table "ci_clusters", force: :cascade do |t|
     t.integer "project_id"
     t.integer "owner_id"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.integer "service_id"
     t.boolean "enabled", default: true
+    t.integer "creation_type"
+    t.string "project_namespace"
     t.string "end_point"
     t.text "ca_cert"
     t.string "token"
     t.string "username"
     t.string "password"
-    t.string "project_namespace"
-    t.integer "creation_type"
+    t.string "gcp_project_id"
+    t.string "cluster_zone"
+    t.string "cluster_name"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
   end
 
   create_table "ci_group_variables", force: :cascade do |t|
@@ -1701,6 +1705,7 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_foreign_key "ci_builds", "ci_stages", column: "stage_id", name: "fk_3a9eaa254d", on_delete: :cascade
   add_foreign_key "ci_builds", "projects", name: "fk_befce0568a", on_delete: :cascade
   add_foreign_key "ci_clusters", "projects"
+  add_foreign_key "ci_clusters", "services"
   add_foreign_key "ci_clusters", "users", column: "owner_id"
   add_foreign_key "ci_group_variables", "namespaces", column: "group_id", name: "fk_33ae4d58d8", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedule_variables", "ci_pipeline_schedules", column: "pipeline_schedule_id", name: "fk_41c35fda51", on_delete: :cascade
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 2c2aefc542c..f2305eab3b7 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -2,6 +2,13 @@ module GoogleApi
   module CloudPlatform
     class Client < GoogleApi::Authentication
       # Google::Apis::ContainerV1::ContainerService.new
+
+      class << self
+        def token_in_session
+          :cloud_platform_access_token
+        end
+      end
+
       def scope
         'https://www.googleapis.com/auth/cloud-platform'
       end
@@ -16,8 +23,16 @@ module GoogleApi
         response
       end
 
-      def projects_zones_clusters_create
-        # TODO
+      def projects_zones_clusters_create(gcp_project_id, cluster_zone, cluster_name, cluster_size)
+        # TODO: Google::Apis::ContainerV1::ContainerService.new
+
+        # TODO: Debug
+        {
+          'end_point' => '111.111.111.111',
+          'ca_cert' => 'XXXXXXXXXXXXXXXXXX',
+          'username' => 'AAA',
+          'password' => 'BBB'
+        }
       end
     end
   end
-- 
cgit v1.2.1


From 360c1470573a34ed47b6bf594339b122900ea6d9 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 7 Sep 2017 17:14:21 +0200
Subject: Disable comment form when discussion locked for user

---
 .../javascripts/notes/components/issue_comment_form.vue  |  3 +++
 .../notes/components/issue_discussion_locked_widget.vue  | 16 ++++++++++++++++
 app/serializers/issue_entity.rb                          |  2 +-
 app/views/shared/notes/_notes_with_form.html.haml        | 10 ++++++----
 4 files changed, 26 insertions(+), 5 deletions(-)
 create mode 100644 app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue

diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index 1b27e74eeb6..afd58b7ceb7 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -9,6 +9,7 @@
   import eventHub from '../event_hub';
   import issueWarning from '../../vue_shared/components/issue/issue_warning.vue';
   import issueNoteSignedOutWidget from './issue_note_signed_out_widget.vue';
+  import issueDiscussionLockedWidget from './issue_discussion_locked_widget.vue';
   import markdownField from '../../vue_shared/components/markdown/field.vue';
   import userAvatarLink from '../../vue_shared/components/user_avatar/user_avatar_link.vue';
   import issuableStateMixin from '../mixins/issuable_state';
@@ -29,6 +30,7 @@
     components: {
       issueWarning,
       issueNoteSignedOutWidget,
+      issueDiscussionLockedWidget,
       markdownField,
       userAvatarLink,
     },
@@ -239,6 +241,7 @@
 <template>
   <div>
     <issue-note-signed-out-widget v-if="!isLoggedIn" />
+    <issue-discussion-locked-widget v-else-if="!canCreate" />
     <ul
       v-else
       class="notes notes-form timeline">
diff --git a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
new file mode 100644
index 00000000000..7169117421b
--- /dev/null
+++ b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
@@ -0,0 +1,16 @@
+<script>
+  import { mapGetters } from 'vuex';
+
+  export default {
+    name: 'discussionLockedWidget',
+  };
+
+</script>
+
+<template>
+  <div class="disabled-comment text-center">
+    <span class="issuable-note-warning">
+      This issue is locked. Only <b>project members</b> can comment.
+     </span>
+  </div>
+</template>
diff --git a/app/serializers/issue_entity.rb b/app/serializers/issue_entity.rb
index aa896b40d28..10d3ad0214b 100644
--- a/app/serializers/issue_entity.rb
+++ b/app/serializers/issue_entity.rb
@@ -15,7 +15,7 @@ class IssueEntity < IssuableEntity
 
   expose :current_user do
     expose :can_create_note do |issue|
-      can?(request.current_user, :create_note, issue.project)
+      can?(request.current_user, :create_note, issue)
     end
 
     expose :can_update do |issue|
diff --git a/app/views/shared/notes/_notes_with_form.html.haml b/app/views/shared/notes/_notes_with_form.html.haml
index 371a9523de9..9a9a809757f 100644
--- a/app/views/shared/notes/_notes_with_form.html.haml
+++ b/app/views/shared/notes/_notes_with_form.html.haml
@@ -25,9 +25,11 @@
     = link_to "sign in", new_session_path(:user, redirect_to_referer: 'yes'), class: 'js-sign-in-link'
     to comment
 - elsif discussion_locked
-  .discussion_locked
-    %span
+  .disabled-comment.text-center.prepend-top-default
+    %span.issuable-note-warning
       This
-      = issuable.class.to_s
-      has been locked. Posting comments has been restricted to project members.
+      = issuable.class.to_s.titleize
+      is locked. Only
+      %b project members
+      can comment.
 %script.js-notes-data{ type: "application/json" }= initial_notes_data(autocomplete).to_json.html_safe
-- 
cgit v1.2.1


From 4971b85a52ccbca3ebd7ac3516d78b2fd94b0aec Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 7 Sep 2017 17:53:52 +0200
Subject: add feature specs for discussion lock

---
 app/views/shared/notes/_notes_with_form.html.haml  |   2 +-
 spec/features/issuables/discussion_lock_spec.rb    | 106 +++++++++++++++++++++
 .../merge_requests/discussion_lock_spec.rb         |  49 ++++++++++
 3 files changed, 156 insertions(+), 1 deletion(-)
 create mode 100644 spec/features/issuables/discussion_lock_spec.rb
 create mode 100644 spec/features/merge_requests/discussion_lock_spec.rb

diff --git a/app/views/shared/notes/_notes_with_form.html.haml b/app/views/shared/notes/_notes_with_form.html.haml
index 9a9a809757f..1e0bc18f2dc 100644
--- a/app/views/shared/notes/_notes_with_form.html.haml
+++ b/app/views/shared/notes/_notes_with_form.html.haml
@@ -28,7 +28,7 @@
   .disabled-comment.text-center.prepend-top-default
     %span.issuable-note-warning
       This
-      = issuable.class.to_s.titleize
+      = issuable.class.to_s.titleize.underscore
       is locked. Only
       %b project members
       can comment.
diff --git a/spec/features/issuables/discussion_lock_spec.rb b/spec/features/issuables/discussion_lock_spec.rb
new file mode 100644
index 00000000000..1c54293de93
--- /dev/null
+++ b/spec/features/issuables/discussion_lock_spec.rb
@@ -0,0 +1,106 @@
+require 'spec_helper'
+
+describe 'Discussion Lock', :js do
+  let(:user) { create(:user) }
+  let(:issue) { create(:issue, project: project, author: user) }
+  let(:project) { create(:project, :public) }
+
+  before do
+    sign_in(user)
+  end
+
+  context 'when a user is a team member' do
+    before do
+      project.add_developer(user)
+    end
+
+    context 'when the discussion is unlocked' do
+      it 'the user can lock the issue' do
+        visit project_issue_path(project, issue)
+
+        expect(find('.issuable-sidebar')).to have_content('Unlocked')
+
+        page.within('.issuable-sidebar') do
+          find('.lock-edit').click
+          click_button('Lock')
+        end
+
+        expect(find('#notes')).to have_content('locked this issue')
+      end
+    end
+
+    context 'when the discussion is locked' do
+      before do
+        issue.update_attribute(:discussion_locked, true)
+        visit project_issue_path(project, issue)
+      end
+
+      it 'the user can unlock the issue' do
+        expect(find('.issuable-sidebar')).to have_content('Locked')
+
+        page.within('.issuable-sidebar') do
+          find('.lock-edit').click
+          click_button('Unlock')
+        end
+
+        expect(find('#notes')).to have_content('unlocked this issue')
+        expect(find('.issuable-sidebar')).to have_content('Unlocked')
+      end
+
+      it 'the user can create a comment' do
+        page.within('#notes .js-main-target-form') do
+          fill_in 'note[note]', with: 'Some new comment'
+          click_button 'Comment'
+        end
+
+        wait_for_requests
+
+        expect(find('div#notes')).to have_content('Some new comment')
+      end
+    end
+  end
+
+  context 'when a user is not a team member' do
+    context 'when the discussion is unlocked' do
+      before do
+        visit project_issue_path(project, issue)
+      end
+
+      it 'the user can not lock the issue' do
+        expect(find('.issuable-sidebar')).to have_content('Unlocked')
+        expect(find('.issuable-sidebar')).not_to have_selector('.lock-edit')
+      end
+
+      it 'the user can create a comment' do
+        page.within('#notes .js-main-target-form') do
+          fill_in 'note[note]', with: 'Some new comment'
+          click_button 'Comment'
+        end
+
+        wait_for_requests
+
+        expect(find('div#notes')).to have_content('Some new comment')
+      end
+    end
+
+    context 'when the discussion is locked' do
+      before do
+        issue.update_attribute(:discussion_locked, true)
+        visit project_issue_path(project, issue)
+      end
+
+      it 'the user can not unlock the issue' do
+        expect(find('.issuable-sidebar')).to have_content('Locked')
+        expect(find('.issuable-sidebar')).not_to have_selector('.lock-edit')
+      end
+
+      it 'the user can not create a comment' do
+        page.within('#notes') do
+          expect(page).not_to have_selector('js-main-target-form')
+          expect(page.find('.disabled-comment')).
+            to have_content('This issue is locked. Only project members can comment.')
+        end
+      end
+    end
+  end
+end
diff --git a/spec/features/merge_requests/discussion_lock_spec.rb b/spec/features/merge_requests/discussion_lock_spec.rb
new file mode 100644
index 00000000000..85fd221a567
--- /dev/null
+++ b/spec/features/merge_requests/discussion_lock_spec.rb
@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+describe 'Discussion Lock', :js do
+  let(:user) { create(:user) }
+  let(:merge_request) { create(:merge_request, source_project: project, author: user) }
+  let(:project) { create(:project, :public, :repository) }
+
+  before do
+    sign_in(user)
+  end
+
+  context 'when the discussion is locked' do
+    before do
+      merge_request.update_attribute(:discussion_locked, true)
+    end
+
+    context 'when a user is a team member' do
+      before do
+        project.add_developer(user)
+        visit project_merge_request_path(project, merge_request)
+      end
+
+      it 'the user can create a comment' do
+        page.within('.issuable-discussion #notes .js-main-target-form') do
+          fill_in 'note[note]', with: 'Some new comment'
+          click_button 'Comment'
+        end
+
+        wait_for_requests
+
+        expect(find('.issuable-discussion #notes')).to have_content('Some new comment')
+      end
+    end
+
+    context 'when a user is not a team member' do
+      before do
+        visit project_merge_request_path(project, merge_request)
+      end
+
+      it 'the user can not create a comment' do
+        page.within('.issuable-discussion #notes') do
+          expect(page).not_to have_selector('js-main-target-form')
+          expect(page.find('.disabled-comment')).
+            to have_content('This merge request is locked. Only project members can comment.')
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From a5b5a0de56c055baead6f55b15b1fa4b2d298329 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 7 Sep 2017 18:03:41 +0200
Subject: use downcase instead of underscore

---
 app/views/shared/notes/_notes_with_form.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/shared/notes/_notes_with_form.html.haml b/app/views/shared/notes/_notes_with_form.html.haml
index 1e0bc18f2dc..7da17e5b6db 100644
--- a/app/views/shared/notes/_notes_with_form.html.haml
+++ b/app/views/shared/notes/_notes_with_form.html.haml
@@ -28,7 +28,7 @@
   .disabled-comment.text-center.prepend-top-default
     %span.issuable-note-warning
       This
-      = issuable.class.to_s.titleize.underscore
+      = issuable.class.to_s.titleize.downcase
       is locked. Only
       %b project members
       can comment.
-- 
cgit v1.2.1


From f9587bc878c724a0aad8cb8693a0a827e4f1473f Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Thu, 7 Sep 2017 22:20:30 +0200
Subject: update changelog

# Conflicts:
#	changelogs/unreleased/18608-lock-issues.yml
---
 changelogs/unreleased/18608-lock-issues.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/changelogs/unreleased/18608-lock-issues.yml b/changelogs/unreleased/18608-lock-issues.yml
index 0f22fe691e3..7d907f744f6 100644
--- a/changelogs/unreleased/18608-lock-issues.yml
+++ b/changelogs/unreleased/18608-lock-issues.yml
@@ -1,5 +1,4 @@
----
-title: Add lock feature to issue and merge request sidebar
+title: Discussion lock for issues and merge requests
 merge_request:
 author:
 type: added
-- 
cgit v1.2.1


From cca510028ab9253c3768e06b9ad6c4c5e3905c5d Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Tue, 26 Sep 2017 08:56:04 +0200
Subject: add discussion lock icon to the system_note_helper

---
 app/helpers/system_note_helper.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/helpers/system_note_helper.rb b/app/helpers/system_note_helper.rb
index d7eaf6ce24d..cb2c5561aa6 100644
--- a/app/helpers/system_note_helper.rb
+++ b/app/helpers/system_note_helper.rb
@@ -19,7 +19,9 @@ module SystemNoteHelper
     'discussion' => 'comment',
     'moved' => 'arrow-right',
     'outdated' => 'pencil',
-    'duplicate' => 'issue-duplicate'
+    'duplicate' => 'issue-duplicate',
+    'locked' => 'locked',
+    'unlocked' => 'unlocked'
   }.freeze
 
   def system_note_icon_name(note)
-- 
cgit v1.2.1


From d65cd0a68066c20250a3b7cbf5f6e3767f359c41 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 17:46:09 +0900
Subject: Tie KubernetesService

---
 app/controllers/projects/clusters_controller.rb | 40 ++++++++++++++++++-------
 app/models/ci/cluster.rb                        |  1 +
 config/routes/project.rb                        |  3 +-
 lib/google_api/cloud_platform/client.rb         |  2 +-
 4 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 2aafc6364eb..0d9707a8ff8 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -32,8 +32,10 @@ class Projects::ClustersController < Projects::ApplicationController
   # - If create on GKE, Use Google::Apis::ContainerV1::ContainerService
   # - If create manually, save in db (Prob, Project > Setting)
   # - Dry up with Service
+  # - Transaction
   def create
     if params['creation_type'] == 'on_gke'
+      # Create a cluster on GKE
       results = api_client.projects_zones_clusters_create(
         params['gcp_project_id'],
         params['cluster_zone'],
@@ -41,22 +43,24 @@ class Projects::ClustersController < Projects::ApplicationController
         params['cluster_size']
       )
 
-      # TODO: How to create
-      project.kubernetes_service.save(
-        end_point: results['end_point'],
-        ca_cert: results['ca_cert'],
-        token: nil,
-        username: results['username'],
-        password: results['password'],
-        project_namespace: params['project_namespace']
-      )
+      # Update service
+      kubernetes_service.attributes = service_params(
+          active: true,
+          api_url: results['end_point'],
+          ca_pem: results['ca_cert'], # TODO: Decode Base64
+          namespace: params['project_namespace'],
+          token: 'aaa' # TODO: username/password
+        )
 
+      kubernetes_service.save!
+
+      # Save info
       project.clusters.create(
         creation_type: params['creation_type'],
         gcp_project_id: params['gcp_project_id'],
         cluster_zone: params['cluster_zone'],
         cluster_name: params['cluster_name'],
-        kubernetes_service: project.kubernetes_service
+        service: kubernetes_service
       )
     elsif params['creation_type'] == 'manual'
       # TODO: Transaction
@@ -121,7 +125,7 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def cluster
     # Each project has only one cluster, for now. In the future iteraiton, we'll support multiple clusters
-    @cluster ||= project.clusters.first
+    @cluster ||= project.clusters.last
   end
 
   # def cluster_params
@@ -136,4 +140,18 @@ class Projects::ClustersController < Projects::ApplicationController
         state: namespace_project_clusters_url.to_s
       )
   end
+
+  def kubernetes_service
+    @kubernetes_service ||= project.find_or_initialize_service('kubernetes')
+  end
+
+  def service_params(active:, api_url:, ca_pem:, namespace:, token:)
+    {
+      active: active,
+      api_url: api_url,
+      ca_pem: ca_pem,
+      namespace: namespace,
+      token: token
+    }
+  end
 end
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index 2e614a1a373..85dcd3c4f58 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -4,6 +4,7 @@ module Ci
 
     belongs_to :project
     belongs_to :owner, class_name: 'User'
+    belongs_to :service
 
     enum creation_type: {
       unknown: nil,
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 5a43e2274a6..27160d8c364 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -183,10 +183,11 @@ constraints(ProjectUrlConstrainer.new) do
         end
       end
 
-      resources :clusters, except: [:show, :destroy] do
+      resources :clusters, except: [:edit, :show, :destroy] do
         collection do
           get :gcp_projects # TODO: This doesn't belong here. Grape or under user. Hint. Serilizer
           get :gke_zones
+          get :edit
         end
       end
 
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index f2305eab3b7..baaf2e0d0fb 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -28,7 +28,7 @@ module GoogleApi
 
         # TODO: Debug
         {
-          'end_point' => '111.111.111.111',
+          'end_point' => 'https://111.111.111.111',
           'ca_cert' => 'XXXXXXXXXXXXXXXXXX',
           'username' => 'AAA',
           'password' => 'BBB'
-- 
cgit v1.2.1


From 8a9dea943e0925788ce81936cb26d858b858e7d7 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 01:45:02 +0900
Subject: ok

---
 .../gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml       | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml

diff --git a/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml b/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml
new file mode 100644
index 00000000000..13ec113167f
--- /dev/null
+++ b/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml
@@ -0,0 +1,5 @@
+---
+title: Bump google-api-client Gem from 0.8.6 to 0.13.6
+merge_request: 
+author:
+type: other
-- 
cgit v1.2.1


From 114b160e4c2f787b48f4b85e241cbab09617377a Mon Sep 17 00:00:00 2001
From: Lin Jen-Shin <godfat@godfat.org>
Date: Tue, 26 Sep 2017 09:12:36 +0000
Subject: Only update gems we need

---
 Gemfile.lock | 64 +++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 33 insertions(+), 31 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 4b2f86fe48d..a13ab3e3305 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -45,7 +45,8 @@ GEM
     adamantium (0.2.0)
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
-    addressable (2.3.8)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
     akismet (2.0.0)
     allocations (1.0.5)
     arel (6.0.4)
@@ -62,10 +63,6 @@ GEM
     attr_encrypted (3.0.3)
       encryptor (~> 3.0.0)
     attr_required (1.0.0)
-    autoparse (0.3.3)
-      addressable (>= 2.3.1)
-      extlib (>= 0.9.15)
-      multi_json (>= 1.0.0)
     autoprefixer-rails (6.2.3)
       execjs
       json
@@ -146,6 +143,8 @@ GEM
     debugger-ruby_core_source (1.3.8)
     deckar01-task_list (2.0.0)
       html-pipeline
+    declarative (0.0.10)
+    declarative-option (0.1.0)
     default_value_for (3.0.2)
       activerecord (>= 3.2.0, < 5.1)
     descendants_tracker (0.0.4)
@@ -188,13 +187,12 @@ GEM
     excon (0.57.1)
     execjs (2.6.0)
     expression_parser (0.9.0)
-    extlib (0.9.16)
     factory_girl (4.7.0)
       activesupport (>= 3.0.0)
     factory_girl_rails (4.7.0)
       factory_girl (~> 4.7.0)
       railties (>= 3.0.0)
-    faraday (0.12.1)
+    faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
     faraday_middleware (0.11.0.1)
       faraday (>= 0.7.4, < 1.0)
@@ -288,10 +286,10 @@ GEM
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
       multi_json
-    gitlab-grit (2.8.1)
+    gitlab-grit (2.8.2)
       charlock_holmes (~> 0.6)
       diff-lcs (~> 1.1)
-      mime-types (>= 1.16, < 3)
+      mime-types (>= 1.16)
       posix-spawn (~> 0.3)
     gitlab-markup (1.6.2)
     gitlab_omniauth-ldap (2.0.4)
@@ -319,20 +317,16 @@ GEM
       json
       multi_json
       request_store (>= 1.0)
-    google-api-client (0.8.7)
-      activesupport (>= 3.2, < 5.0)
-      addressable (~> 2.3)
-      autoparse (~> 0.3)
-      extlib (~> 0.9)
-      faraday (~> 0.9)
-      googleauth (~> 0.3)
-      launchy (~> 2.4)
-      multi_json (~> 1.10)
-      retriable (~> 1.4)
-      signet (~> 0.6)
+    google-api-client (0.13.6)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (~> 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
     google-protobuf (3.4.0.2)
-    googleauth (0.5.1)
-      faraday (~> 0.9)
+    googleauth (0.5.3)
+      faraday (~> 0.12)
       jwt (~> 1.4)
       logging (~> 2.0)
       memoist (~> 0.12)
@@ -422,8 +416,8 @@ GEM
       multi_json (>= 1.3)
       securecompare
       url_safe_base64
-    json-schema (2.6.2)
-      addressable (~> 2.3.8)
+    json-schema (2.8.0)
+      addressable (>= 2.4)
     jwt (1.5.6)
     kaminari (1.0.1)
       activesupport (>= 4.1.0)
@@ -475,18 +469,20 @@ GEM
     mail (2.6.6)
       mime-types (>= 1.16, < 4)
     mail_room (0.9.1)
-    memoist (0.15.0)
+    memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
     method_source (0.8.2)
-    mime-types (2.99.3)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
     mimemagic (0.3.0)
     mini_mime (0.1.4)
     mini_portile2 (2.3.0)
     minitest (5.7.0)
     mmap2 (2.2.7)
     mousetrap-rails (1.4.6)
-    multi_json (1.12.1)
+    multi_json (1.12.2)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
     mustermann (1.0.0)
@@ -635,6 +631,7 @@ GEM
       pry (~> 0.10)
     pry-rails (0.3.5)
       pry (>= 0.9.10)
+    public_suffix (3.0.0)
     pyu-ruby-sasl (0.0.3.3)
     rack (1.6.8)
     rack-accept (0.4.5)
@@ -717,6 +714,10 @@ GEM
       redis-store (~> 1.2.0)
     redis-store (1.2.0)
       redis (>= 2.2)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
     request_store (1.3.1)
     responders (2.3.0)
       railties (>= 4.2.0, < 5.1)
@@ -724,7 +725,7 @@ GEM
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    retriable (1.4.1)
+    retriable (3.1.1)
     rinku (2.0.0)
     rotp (2.1.2)
     rouge (2.2.1)
@@ -903,6 +904,7 @@ GEM
     tzinfo (1.2.3)
       thread_safe (~> 0.1)
     u2f (0.2.1)
+    uber (0.1.0)
     uglifier (2.7.2)
       execjs (>= 0.3.0)
       json (>= 1.8.0)
@@ -963,7 +965,7 @@ DEPENDENCIES
   ace-rails-ap (~> 4.1.0)
   activerecord_sane_schema_dumper (= 0.2)
   acts-as-taggable-on (~> 4.0)
-  addressable (~> 2.3.8)
+  addressable (~> 2.5.2)
   akismet (~> 2.0)
   allocations (~> 1.0)
   asana (~> 0.6.0)
@@ -1033,7 +1035,7 @@ DEPENDENCIES
   gollum-lib (~> 4.2)
   gollum-rugged_adapter (~> 0.4.4)
   gon (~> 6.1.0)
-  google-api-client (~> 0.8.6)
+  google-api-client (~> 0.13.6)
   gpgme
   grape (~> 1.0)
   grape-entity (~> 0.6.0)
@@ -1051,7 +1053,7 @@ DEPENDENCIES
   jira-ruby (~> 1.4)
   jquery-atwho-rails (~> 1.3.2)
   jquery-rails (~> 4.1.0)
-  json-schema (~> 2.6.2)
+  json-schema (~> 2.8.0)
   jwt (~> 1.5.6)
   kaminari (~> 1.0)
   knapsack (~> 1.11.0)
-- 
cgit v1.2.1


From 3823707a0bc30ffd61e9bdaf5e05ef2a4dc975e1 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 01:19:59 +0900
Subject: Bump google-api-client Gem from 0.8.6 to 0.13.6

---
 Gemfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index 50fb1bcd815..460d9a05292 100644
--- a/Gemfile
+++ b/Gemfile
@@ -105,7 +105,7 @@ gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.1.0'
 
 # for Google storage
-gem 'google-api-client', '~> 0.8.6'
+gem 'google-api-client', '~> 0.13.6'
 
 # for aws storage
 gem 'unf', '~> 0.1.4'
@@ -239,7 +239,7 @@ gem 'rack-proxy', '~> 0.6.0'
 gem 'sass-rails', '~> 5.0.6'
 gem 'uglifier', '~> 2.7.2'
 
-gem 'addressable', '~> 2.3.8'
+gem 'addressable', '~> 2.5.2'
 gem 'bootstrap-sass', '~> 3.3.0'
 gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
@@ -356,7 +356,7 @@ end
 group :test do
   gem 'shoulda-matchers', '~> 3.1.2', require: false
   gem 'email_spec', '~> 1.6.0'
-  gem 'json-schema', '~> 2.6.2'
+  gem 'json-schema', '~> 2.8.0'
   gem 'webmock', '~> 2.3.2'
   gem 'test_after_commit', '~> 1.1'
   gem 'sham_rack', '~> 1.3.6'
-- 
cgit v1.2.1


From 3fb24bc62183f638bad520fed6f8dd168daf6817 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 26 Sep 2017 12:59:00 +0200
Subject: Sort by id, not created_at

---
 app/controllers/projects/jobs_controller.rb | 2 +-
 changelogs/unreleased/jobs-sort-by-id.yml   | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/jobs-sort-by-id.yml

diff --git a/app/controllers/projects/jobs_controller.rb b/app/controllers/projects/jobs_controller.rb
index 96abdac91b6..1b985ea9763 100644
--- a/app/controllers/projects/jobs_controller.rb
+++ b/app/controllers/projects/jobs_controller.rb
@@ -11,7 +11,7 @@ class Projects::JobsController < Projects::ApplicationController
   def index
     @scope = params[:scope]
     @all_builds = project.builds.relevant
-    @builds = @all_builds.order('created_at DESC')
+    @builds = @all_builds.order('ci_builds.id DESC')
     @builds =
       case @scope
       when 'pending'
diff --git a/changelogs/unreleased/jobs-sort-by-id.yml b/changelogs/unreleased/jobs-sort-by-id.yml
new file mode 100644
index 00000000000..ec2c3a17b74
--- /dev/null
+++ b/changelogs/unreleased/jobs-sort-by-id.yml
@@ -0,0 +1,5 @@
+---
+title: Sort JobsController by id, not created_at
+merge_request:
+author:
+type: fixed
-- 
cgit v1.2.1


From 55ac72e56e0cdf6faf2fcd93939d0dd77048a8ee Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 20:34:49 +0900
Subject: Create cluster

---
 app/controllers/projects/clusters_controller.rb | 17 +++++++--
 app/views/projects/clusters/_form.html.haml     |  9 +++++
 app/views/projects/clusters/_login.html.haml    |  2 +
 app/views/projects/clusters/edit.html.haml      |  6 ++-
 app/views/projects/clusters/new.html.haml       | 17 +--------
 lib/google_api/cloud_platform/client.rb         | 49 +++++++++++++++----------
 6 files changed, 61 insertions(+), 39 deletions(-)
 create mode 100644 app/views/projects/clusters/_form.html.haml
 create mode 100644 app/views/projects/clusters/_login.html.haml

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 0d9707a8ff8..bc7e23bae59 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -37,10 +37,11 @@ class Projects::ClustersController < Projects::ApplicationController
     if params['creation_type'] == 'on_gke'
       # Create a cluster on GKE
       results = api_client.projects_zones_clusters_create(
-        params['gcp_project_id'],
-        params['cluster_zone'],
-        params['cluster_name'],
-        params['cluster_size']
+        project_id: params['gcp_project_id'],
+        zone: params['cluster_zone'],
+        cluster_name: params['cluster_name'],
+        cluster_size: params['cluster_size'],
+        machine_type: params['machine_type']
       )
 
       # Update service
@@ -90,7 +91,15 @@ class Projects::ClustersController < Projects::ApplicationController
   def edit
     unless session[GoogleApi::CloudPlatform::Client.token_in_session]
       @authorize_url = api_client.authorize_url
+      render :edit
     end
+
+    # Get cluster information
+    api_client.projects_zones_clusters_get(
+      project_id: cluster.gcp_project_id,
+      zone: cluster.cluster_zone,
+      cluster_id: cluster.cluster_name
+    )
   end
 
   def update
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
new file mode 100644
index 00000000000..0718fb97df2
--- /dev/null
+++ b/app/views/projects/clusters/_form.html.haml
@@ -0,0 +1,9 @@
+Create a new cluster
+%br
+Avaiable GCP project lists
+%br
+Avaiable zones
+%br
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: 'gke-test-creation', gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+%br
+= link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
diff --git a/app/views/projects/clusters/_login.html.haml b/app/views/projects/clusters/_login.html.haml
new file mode 100644
index 00000000000..ccb5d68ac4c
--- /dev/null
+++ b/app/views/projects/clusters/_login.html.haml
@@ -0,0 +1,2 @@
+Login
+%p= link_to("authenticate from here", @authorize_url)
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 6445b3ee75d..83c6ad7dae6 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,2 +1,6 @@
 edit/show cluster
-= @cluster.inspect
+
+- if @authorize_url
+  = render "login"
+- else
+  = @cluster.inspect
\ No newline at end of file
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index b716cc51c20..6ab22a5d351 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -1,17 +1,4 @@
-Create a new cluster
-
-%br
-
 - if @authorize_url
-  I have not authenticated yet. I can authenticate from
-  = link_to("authenticate from here", @authorize_url)
+  = render "login"
 - else
-  I have already authenticated.
-  %br
-  Avaiable GCP project lists
-  %br
-  Avaiable zones
-  %br
-  = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: 'new-cluster-shinya', gcp_project_id: 'gitlab-internal', cluster_zone: 'gitlab-internal', cluster_size: 'gitlab-internal', project_namespace: 'aaa'), method: :post
-  %br
-  = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
+  = render "form"
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index baaf2e0d0fb..301b4824bb0 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -1,8 +1,8 @@
+require 'google/apis/container_v1'
+
 module GoogleApi
   module CloudPlatform
     class Client < GoogleApi::Authentication
-      # Google::Apis::ContainerV1::ContainerService.new
-
       class << self
         def token_in_session
           :cloud_platform_access_token
@@ -13,26 +13,37 @@ module GoogleApi
         'https://www.googleapis.com/auth/cloud-platform'
       end
 
-      def projects_zones_clusters_get
-        # TODO: 
-        # service = Google::Apis::ContainerV1::ContainerService.new
-        # service.authorization = access_token
-        # project_id = params['project_id']
-        # ...
-        # response = service.list_zone_clusters(project_id, zone)
-        response
+      def projects_zones_clusters_get(project_id:, zone:, cluster_id:)
+        service = Google::Apis::ContainerV1::ContainerService.new
+        service.authorization = access_token
+
+        response = service.get_zone_cluster(project_id, zone, cluster_id)
+        response.to_json
       end
 
-      def projects_zones_clusters_create(gcp_project_id, cluster_zone, cluster_name, cluster_size)
-        # TODO: Google::Apis::ContainerV1::ContainerService.new
+      # Responce exmaple 
+      # {"name":"operation-1506424047439-0293f57c","operationType":"CREATE_CLUSTER","selfLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/operations/operation-1506424047439-0293f57c","startTime":"2017-09-26T11:07:27.439033158Z","status":"RUNNING","targetLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/clusters/gke-test-creation","zone":"us-central1-a"}
+      def projects_zones_clusters_create(project_id:, zone:, cluster_name:, cluster_size:, machine_type:)
+        service = Google::Apis::ContainerV1::ContainerService.new
+        service.authorization = access_token
+
+        request_body = Google::Apis::ContainerV1::CreateClusterRequest.new(
+            {
+              "cluster": {
+                "name": cluster_name,
+                "initial_node_count": cluster_size
+              }
+            }
+          )
+
+        # TODO: machine_type : Defailt 3.75 GB
+        response = service.create_cluster(project_id, zone, request_body)
+        puts response.to_json
+        response.to_json
+      end
 
-        # TODO: Debug
-        {
-          'end_point' => 'https://111.111.111.111',
-          'ca_cert' => 'XXXXXXXXXXXXXXXXXX',
-          'username' => 'AAA',
-          'password' => 'BBB'
-        }
+      def get_status(project_id:, zone:, cluster_name:, cluster_size:, machine_type:)
+        # Observe 
       end
     end
   end
-- 
cgit v1.2.1


From e7a8a05659f8c77ef6c1f83a25bae5629513cf96 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 26 Sep 2017 23:05:12 +0900
Subject: Improve ClustersController

---
 app/controllers/projects/clusters_controller.rb | 33 +++++++++---------
 app/views/projects/clusters/_form.html.haml     |  2 +-
 lib/google_api/cloud_platform/client.rb         | 45 +++++++++++++++++++------
 3 files changed, 54 insertions(+), 26 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index bc7e23bae59..b625ff16b54 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -33,22 +33,32 @@ class Projects::ClustersController < Projects::ApplicationController
   # - If create manually, save in db (Prob, Project > Setting)
   # - Dry up with Service
   # - Transaction
+  # - Sidekiq
   def create
     if params['creation_type'] == 'on_gke'
       # Create a cluster on GKE
-      results = api_client.projects_zones_clusters_create(
-        project_id: params['gcp_project_id'],
-        zone: params['cluster_zone'],
-        cluster_name: params['cluster_name'],
-        cluster_size: params['cluster_size'],
-        machine_type: params['machine_type']
+      operation = api_client.projects_zones_clusters_create(
+        params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
+        cluster_size: params['cluster_size'], machine_type: params['machine_type']
+      )
+
+      # wait_operation_done
+      if operation&.operation_type == 'CREATE_CLUSTER'
+        api_client.wait_operation_done(operation.self_link)
+      else
+        raise "TODO: ERROR"
+      end
+
+      # Get cluster details (end point, etc)
+      gke_cluster = api_client.projects_zones_clusters_get(
+        params['gcp_project_id'], params['cluster_zone'], params['cluster_name']
       )
 
       # Update service
       kubernetes_service.attributes = service_params(
           active: true,
-          api_url: results['end_point'],
-          ca_pem: results['ca_cert'], # TODO: Decode Base64
+          api_url: gke_cluster.endpoint,
+          ca_pem: Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate),
           namespace: params['project_namespace'],
           token: 'aaa' # TODO: username/password
         )
@@ -93,13 +103,6 @@ class Projects::ClustersController < Projects::ApplicationController
       @authorize_url = api_client.authorize_url
       render :edit
     end
-
-    # Get cluster information
-    api_client.projects_zones_clusters_get(
-      project_id: cluster.gcp_project_id,
-      zone: cluster.cluster_zone,
-      cluster_id: cluster.cluster_name
-    )
   end
 
   def update
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 0718fb97df2..970b471ee49 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -4,6 +4,6 @@ Avaiable GCP project lists
 %br
 Avaiable zones
 %br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: 'gke-test-creation', gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
 %br
 = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 301b4824bb0..17bca090d5d 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -13,17 +13,19 @@ module GoogleApi
         'https://www.googleapis.com/auth/cloud-platform'
       end
 
-      def projects_zones_clusters_get(project_id:, zone:, cluster_id:)
+      def projects_zones_clusters_get(project_id, zone, cluster_id)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
-        response = service.get_zone_cluster(project_id, zone, cluster_id)
-        response.to_json
+        cluster = service.get_zone_cluster(project_id, zone, cluster_id)
+        puts "#{self.class.name} - #{__callee__}: cluster: #{cluster.inspect}"
+        cluster
       end
 
       # Responce exmaple 
       # {"name":"operation-1506424047439-0293f57c","operationType":"CREATE_CLUSTER","selfLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/operations/operation-1506424047439-0293f57c","startTime":"2017-09-26T11:07:27.439033158Z","status":"RUNNING","targetLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/clusters/gke-test-creation","zone":"us-central1-a"}
-      def projects_zones_clusters_create(project_id:, zone:, cluster_name:, cluster_size:, machine_type:)
+      # TODO: machine_type : Defailt 3.75 GB
+      def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size:, machine_type:)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
@@ -36,14 +38,37 @@ module GoogleApi
             }
           )
 
-        # TODO: machine_type : Defailt 3.75 GB
-        response = service.create_cluster(project_id, zone, request_body)
-        puts response.to_json
-        response.to_json
+        begin
+          operation = service.create_cluster(project_id, zone, request_body)
+        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+          Rails.logger.error("#{self.class.name}: Could not create cluster #{cluster_name}: #{e}")
+        end
+        puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
+        operation
       end
 
-      def get_status(project_id:, zone:, cluster_name:, cluster_size:, machine_type:)
-        # Observe 
+      def projects_zones_operations(project_id, zone, operation_id)
+        service = Google::Apis::ContainerV1::ContainerService.new
+        service.authorization = access_token
+
+        operation = service.get_zone_operation(project_id, zone, operation_id)
+        operation
+      end
+
+      def wait_operation_done(self_link)
+        running = true
+
+        ret = self_link.match(/projects\/(.*)\/zones\/(.*)\/operations\/(.*)/)
+        project_id = ret[1]
+        zone = ret[2]
+        operation_id = ret[3]
+
+        while running
+          operation = projects_zones_operations(project_id, zone, operation_id)
+          if operation.status != 'RUNNING'
+            running = false
+          end
+        end
       end
     end
   end
-- 
cgit v1.2.1


From eb0c7092869ac2eb0782f60d6935f0dc3fe33501 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Wed, 27 Sep 2017 08:30:40 +0200
Subject: fix code style

---
 spec/features/issuables/discussion_lock_spec.rb      | 4 ++--
 spec/features/merge_requests/discussion_lock_spec.rb | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/spec/features/issuables/discussion_lock_spec.rb b/spec/features/issuables/discussion_lock_spec.rb
index 1c54293de93..7ea29ff252b 100644
--- a/spec/features/issuables/discussion_lock_spec.rb
+++ b/spec/features/issuables/discussion_lock_spec.rb
@@ -97,8 +97,8 @@ describe 'Discussion Lock', :js do
       it 'the user can not create a comment' do
         page.within('#notes') do
           expect(page).not_to have_selector('js-main-target-form')
-          expect(page.find('.disabled-comment')).
-            to have_content('This issue is locked. Only project members can comment.')
+          expect(page.find('.disabled-comment'))
+            .to have_content('This issue is locked. Only project members can comment.')
         end
       end
     end
diff --git a/spec/features/merge_requests/discussion_lock_spec.rb b/spec/features/merge_requests/discussion_lock_spec.rb
index 85fd221a567..7bbd3b1e69e 100644
--- a/spec/features/merge_requests/discussion_lock_spec.rb
+++ b/spec/features/merge_requests/discussion_lock_spec.rb
@@ -40,8 +40,8 @@ describe 'Discussion Lock', :js do
       it 'the user can not create a comment' do
         page.within('.issuable-discussion #notes') do
           expect(page).not_to have_selector('js-main-target-form')
-          expect(page.find('.disabled-comment')).
-            to have_content('This merge request is locked. Only project members can comment.')
+          expect(page.find('.disabled-comment'))
+            .to have_content('This merge request is locked. Only project members can comment.')
         end
       end
     end
-- 
cgit v1.2.1


From 9900933432fc05a07b4c3e742c0ec3f295cf773c Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 27 Sep 2017 17:04:25 +0900
Subject: Remove sensitive literal data

---
 app/views/projects/clusters/_form.html.haml | 2 +-
 lib/google_api/cloud_platform/client.rb     | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 970b471ee49..f58e4334abe 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -4,6 +4,6 @@ Avaiable GCP project lists
 %br
 Avaiable zones
 %br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'xxx', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
 %br
 = link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 17bca090d5d..f0ca2c52aa7 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -23,7 +23,6 @@ module GoogleApi
       end
 
       # Responce exmaple 
-      # {"name":"operation-1506424047439-0293f57c","operationType":"CREATE_CLUSTER","selfLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/operations/operation-1506424047439-0293f57c","startTime":"2017-09-26T11:07:27.439033158Z","status":"RUNNING","targetLink":"https://container.googleapis.com/v1/projects/696404988091/zones/us-central1-a/clusters/gke-test-creation","zone":"us-central1-a"}
       # TODO: machine_type : Defailt 3.75 GB
       def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size:, machine_type:)
         service = Google::Apis::ContainerV1::ContainerService.new
-- 
cgit v1.2.1


From e9d05a2cdc24b4dc771344f26e6ffdcf0240e46c Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 27 Sep 2017 21:01:08 +0900
Subject: Add login root. Remove ceration type.

---
 app/controllers/projects/clusters_controller.rb    | 156 +++++++--------------
 app/models/ci/cluster.rb                           |   5 -
 app/views/projects/clusters/_form.html.haml        |   8 +-
 app/views/projects/clusters/_login.html.haml       |   2 -
 app/views/projects/clusters/edit.html.haml         |   7 +-
 app/views/projects/clusters/login.html.haml        |   6 +
 app/views/projects/clusters/new.html.haml          |   7 +-
 ...-google-api-client-gem-from-0-8-6-to-0-13-6.yml |   5 -
 config/routes/project.rb                           |   3 +-
 db/migrate/20170924094327_create_ci_clusters.rb    |   9 --
 db/schema.rb                                       |   1 -
 lib/google_api/authentication.rb                   |  34 ++---
 12 files changed, 80 insertions(+), 163 deletions(-)
 delete mode 100644 app/views/projects/clusters/_login.html.haml
 create mode 100644 app/views/projects/clusters/login.html.haml
 delete mode 100644 changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index b625ff16b54..567c54ea2e2 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -1,9 +1,15 @@
 class Projects::ClustersController < Projects::ApplicationController
-  # before_action :authenticate_google_api
   before_action :cluster
-
+  before_action :authorize_google_api, except: [:login]
   # before_action :authorize_admin_clusters! # TODO: Authentication
 
+  def login
+    begin
+      @authorize_url = api_client.authorize_url
+    rescue GoogleApi::Authentication::ConfigMissingError
+    end
+  end
+
   def index
     if cluster
       redirect_to action: 'edit'
@@ -12,97 +18,54 @@ class Projects::ClustersController < Projects::ApplicationController
     end
   end
 
-  ##
-  # TODO: 
-  # - Show form for "Create on Google Container Engine"
-  # - Show form for "Use existing kubernets cluster"
-  # - If user has not authroized yet, Show "Sign in with Google" button
-  # - If user has already authroized, Skip "Sign in with Google" button
-  # - user.is_authenticated_for_gcp?
-  # - user.authenticate_for_gcp!
-  # - Create this module which can be used from view
   def new
-    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
-      @authorize_url = api_client.authorize_url
-    end
   end
 
-  ##
-  # TODO: 
-  # - If create on GKE, Use Google::Apis::ContainerV1::ContainerService
-  # - If create manually, save in db (Prob, Project > Setting)
-  # - Dry up with Service
-  # - Transaction
-  # - Sidekiq
   def create
-    if params['creation_type'] == 'on_gke'
-      # Create a cluster on GKE
-      operation = api_client.projects_zones_clusters_create(
-        params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
-        cluster_size: params['cluster_size'], machine_type: params['machine_type']
-      )
-
-      # wait_operation_done
-      if operation&.operation_type == 'CREATE_CLUSTER'
-        api_client.wait_operation_done(operation.self_link)
-      else
-        raise "TODO: ERROR"
-      end
+    # Create a cluster on GKE
+    operation = api_client.projects_zones_clusters_create(
+      params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
+      cluster_size: params['cluster_size'], machine_type: params['machine_type']
+    )
+
+    # wait_operation_done
+    if operation&.operation_type == 'CREATE_CLUSTER'
+      api_client.wait_operation_done(operation.self_link)
+    else
+      raise "TODO: ERROR"
+    end
 
-      # Get cluster details (end point, etc)
-      gke_cluster = api_client.projects_zones_clusters_get(
-        params['gcp_project_id'], params['cluster_zone'], params['cluster_name']
+    # Get cluster details (end point, etc)
+    gke_cluster = api_client.projects_zones_clusters_get(
+      params['gcp_project_id'], params['cluster_zone'], params['cluster_name']
+    )
+
+    # Update service
+    kubernetes_service.attributes = service_params(
+        active: true,
+        api_url: gke_cluster.endpoint,
+        ca_pem: Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate),
+        namespace: params['project_namespace'],
+        token: 'aaa' # TODO: username/password
       )
 
-      # Update service
-      kubernetes_service.attributes = service_params(
-          active: true,
-          api_url: gke_cluster.endpoint,
-          ca_pem: Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate),
-          namespace: params['project_namespace'],
-          token: 'aaa' # TODO: username/password
-        )
-
-      kubernetes_service.save!
-
-      # Save info
-      project.clusters.create(
-        creation_type: params['creation_type'],
-        gcp_project_id: params['gcp_project_id'],
-        cluster_zone: params['cluster_zone'],
-        cluster_name: params['cluster_name'],
-        service: kubernetes_service
-      )
-    elsif params['creation_type'] == 'manual'
-      # TODO: Transaction
-      project.kubernetes_service.save(
-        end_point: params['end_point'],
-        ca_cert: params['ca_cert'],
-        token: params['token'],
-        username: params['username'],
-        password: params['password'],
-        project_namespace: params['project_namespace']
-      )
+    kubernetes_service.save!
 
-      project.clusters.create(
-        creation_type: params['creation_type'],
-        kubernetes_service: project.kubernetes_service
-      )
-    end
+    # Save info
+    project.clusters.create(
+      creation_type: params['creation_type'],
+      gcp_project_id: params['gcp_project_id'],
+      cluster_zone: params['cluster_zone'],
+      cluster_name: params['cluster_name'],
+      service: kubernetes_service
+    )
 
     redirect_to action: 'index'
   end
 
-  # TODO: Show results/status. Edits Swtich for enable/disable.
-  # If created with GKE, non-editable form. enable/disable switch.
-  # If created manually, editable form. enable/disable switch.
-  # GKE params are   on-off swtich
-  # Manul params are on-off swtich, Endpoint, CACert, k8s Token, Proj namespace.
   def edit
-    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
-      @authorize_url = api_client.authorize_url
-      render :edit
-    end
+    # TODO: If on, do we override parameter?
+    # TODO: If off, do we override parameter?
   end
 
   def update
@@ -110,40 +73,13 @@ class Projects::ClustersController < Projects::ApplicationController
     render :edit
   end
 
-  # In presenter
-  # TODO: Generate a link to the cluster on GKE
-
-  def gcp_projects
-    # api_client.blah
-    # TODO: Return all avaiable GCP Projects.
-    # TODO: Return json
-    # TODO: Dry with concern
-  end
-
-  def gke_zones
-    # api_client.blah
-    # TODO: Return all avaiable zones on GKE.
-    # TODO: Return json
-    # TODO: Dry with concern
-  end
-
   private
 
-  # def authenticate_google_api
-  #   if cluster&.on_gke? && session[access_token_key].blank?
-  #     redirect_to api_client.authorize_url(callback_import_url)
-  #   end
-  # end
-
   def cluster
     # Each project has only one cluster, for now. In the future iteraiton, we'll support multiple clusters
     @cluster ||= project.clusters.last
   end
 
-  # def cluster_params
-  #   params.require(:cluster).permit(:aaa)
-  # end
-
   def api_client
     @api_client ||=
       GoogleApi::CloudPlatform::Client.new(
@@ -166,4 +102,10 @@ class Projects::ClustersController < Projects::ApplicationController
       token: token
     }
   end
+
+  def authorize_google_api
+    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
+      redirect_to action: 'login'
+    end
+  end
 end
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index 85dcd3c4f58..855280ef024 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -6,10 +6,5 @@ module Ci
     belongs_to :owner, class_name: 'User'
     belongs_to :service
 
-    enum creation_type: {
-      unknown: nil,
-      on_gke: 1,
-      manual: 2
-    }    
   end
 end
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index f58e4334abe..8b3c23d5d28 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -1,9 +1,3 @@
 Create a new cluster
 %br
-Avaiable GCP project lists
-%br
-Avaiable zones
-%br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'on_gke', cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'xxx', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
-%br
-= link_to "Use existing kubernets cluster", namespace_project_clusters_path(@project.namespace, @project, creation_type: 'manual', end_point: 'xxx.xxx.xxx.xxx', ca_cert: 'xxx...xxx', token: 'xxx', project_namespace: 'aaa'), method: :post
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
diff --git a/app/views/projects/clusters/_login.html.haml b/app/views/projects/clusters/_login.html.haml
deleted file mode 100644
index ccb5d68ac4c..00000000000
--- a/app/views/projects/clusters/_login.html.haml
+++ /dev/null
@@ -1,2 +0,0 @@
-Login
-%p= link_to("authenticate from here", @authorize_url)
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 83c6ad7dae6..518fcf2530a 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,6 +1,3 @@
 edit/show cluster
-
-- if @authorize_url
-  = render "login"
-- else
-  = @cluster.inspect
\ No newline at end of file
+%br
+= @cluster.inspect
diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
new file mode 100644
index 00000000000..ddc909d12ca
--- /dev/null
+++ b/app/views/projects/clusters/login.html.haml
@@ -0,0 +1,6 @@
+Login
+%br
+- if @authorize_url
+  = link_to("authenticate from here", @authorize_url)
+- else
+  You have not configrued GitLab properly. So we can not proceed authentication. Please check if you have set up omniauth->providers->google_oauth2 in gitlab.yml
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index 6ab22a5d351..7433f6759a0 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -1,4 +1,3 @@
-- if @authorize_url
-  = render "login"
-- else
-  = render "form"
+Create a cluster
+%br
+= render "form"
diff --git a/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml b/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml
deleted file mode 100644
index 13ec113167f..00000000000
--- a/changelogs/unreleased/gem-sm-bump-google-api-client-gem-from-0-8-6-to-0-13-6.yml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Bump google-api-client Gem from 0.8.6 to 0.13.6
-merge_request: 
-author:
-type: other
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 27160d8c364..23c3f87df81 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -185,8 +185,7 @@ constraints(ProjectUrlConstrainer.new) do
 
       resources :clusters, except: [:edit, :show, :destroy] do
         collection do
-          get :gcp_projects # TODO: This doesn't belong here. Grape or under user. Hint. Serilizer
-          get :gke_zones
+          get :login
           get :edit
         end
       end
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index 7a35fe35605..dce3298cde2 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -9,7 +9,6 @@ class CreateCiClusters < ActiveRecord::Migration
 
       # General
       t.boolean :enabled, default: true
-      t.integer :creation_type # manual or on_gke
 
       # k8s integration specific
       t.string :project_namespace
@@ -30,14 +29,6 @@ class CreateCiClusters < ActiveRecord::Migration
       t.datetime_with_timezone :updated_at, null: false
     end
 
-    # create_table :ci_gke_clusters do |t|
-    #   t.integer :ci_cluster_id
-    #   t.string :gcp_project_id
-    #   t.string :cluster_zone
-    #   t.string :cluster_name
-    # end
-    # add_foreign_key :ci_gke_clusters, :ci_clusters
-
     # TODO: fk, index, encypt
 
     add_foreign_key :ci_clusters, :projects
diff --git a/db/schema.rb b/db/schema.rb
index 8000229d5fa..3908f06821e 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -272,7 +272,6 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.integer "owner_id"
     t.integer "service_id"
     t.boolean "enabled", default: true
-    t.integer "creation_type"
     t.string "project_namespace"
     t.string "end_point"
     t.text "ca_cert"
diff --git a/lib/google_api/authentication.rb b/lib/google_api/authentication.rb
index d7b473525fb..4c9016e1085 100644
--- a/lib/google_api/authentication.rb
+++ b/lib/google_api/authentication.rb
@@ -2,28 +2,14 @@ module GoogleApi
   class Authentication
     attr_reader :access_token, :redirect_uri, :state
 
+    ConfigMissingError = Class.new(StandardError)
+
     def initialize(access_token, redirect_uri, state: nil)
       @access_token = access_token
       @redirect_uri = redirect_uri
       @state = state
     end
 
-    def client
-      return @client if defined?(@client)
-
-      unless config
-        raise 'OAuth configuration for google_oauth2 missing.'
-      end
-
-      @client = ::OAuth2::Client.new(
-        config.app_id,
-        config.app_secret,
-        site: 'https://accounts.google.com',
-        token_url: '/o/oauth2/token', 
-        authorize_url: '/o/oauth2/auth'
-      )
-    end
-
     def authorize_url
       client.auth_code.authorize_url(
         redirect_uri: redirect_uri,
@@ -47,5 +33,21 @@ module GoogleApi
     def config
       Gitlab.config.omniauth.providers.find { |provider| provider.name == "google_oauth2" }
     end
+
+    def client
+      return @client if defined?(@client)
+
+      unless config
+        raise ConfigMissingError
+      end
+
+      @client = ::OAuth2::Client.new(
+        config.app_id,
+        config.app_secret,
+        site: 'https://accounts.google.com',
+        token_url: '/o/oauth2/token', 
+        authorize_url: '/o/oauth2/auth'
+      )
+    end
   end
 end
-- 
cgit v1.2.1


From 362bd88471d52b595f9dcc890a1d993ae88cafd5 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 27 Sep 2017 13:35:31 +0100
Subject: Fix static analysis

---
 .../javascripts/notes/components/issue_discussion_locked_widget.vue     | 2 --
 1 file changed, 2 deletions(-)

diff --git a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
index 7169117421b..fa2ff6e5c58 100644
--- a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
+++ b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
@@ -1,6 +1,4 @@
 <script>
-  import { mapGetters } from 'vuex';
-
   export default {
     name: 'discussionLockedWidget',
   };
-- 
cgit v1.2.1


From 613a6cc8b5b3d94314cac8af4a5d9aeef6ff1e6f Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 27 Sep 2017 13:35:42 +0100
Subject: Fix locked and unlocked icons

---
 app/helpers/system_note_helper.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/helpers/system_note_helper.rb b/app/helpers/system_note_helper.rb
index cb2c5561aa6..00fe67d6ffb 100644
--- a/app/helpers/system_note_helper.rb
+++ b/app/helpers/system_note_helper.rb
@@ -20,8 +20,8 @@ module SystemNoteHelper
     'moved' => 'arrow-right',
     'outdated' => 'pencil',
     'duplicate' => 'issue-duplicate',
-    'locked' => 'locked',
-    'unlocked' => 'unlocked'
+    'locked' => 'lock',
+    'unlocked' => 'lock-open'
   }.freeze
 
   def system_note_icon_name(note)
-- 
cgit v1.2.1


From 5fbf4069f6bc17dcc1ceeb81c28498b872882a6a Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 27 Sep 2017 21:53:50 +0900
Subject: Fetch k8s token from k8s username/password

---
 app/controllers/projects/clusters_controller.rb   | 23 ++++++++++++++++++++---
 app/models/project_services/kubernetes_service.rb | 18 ++++++++++++++++--
 app/views/projects/clusters/_form.html.haml       |  3 ++-
 app/views/projects/clusters/edit.html.haml        |  1 +
 4 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 567c54ea2e2..b6e2b2a723b 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -40,20 +40,37 @@ class Projects::ClustersController < Projects::ApplicationController
       params['gcp_project_id'], params['cluster_zone'], params['cluster_name']
     )
 
+    # Get k8s token
+    token = ''
+    KubernetesService.new.tap do |ks|
+      ks.api_url = 'https://' + gke_cluster.endpoint
+      ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+      ks.username = gke_cluster.master_auth.username
+      ks.password = gke_cluster.master_auth.password
+      secrets = ks.read_secrets
+      secrets.each do |secret|
+        name = secret.dig('metadata', 'name')
+        if /default-token/ =~ name
+          token_base64 = secret.dig('data', 'token')
+          token = Base64.decode64(token_base64)
+          break
+        end
+      end
+    end
+
     # Update service
     kubernetes_service.attributes = service_params(
         active: true,
-        api_url: gke_cluster.endpoint,
+        api_url: 'https://' + gke_cluster.endpoint,
         ca_pem: Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate),
         namespace: params['project_namespace'],
-        token: 'aaa' # TODO: username/password
+        token: token
       )
 
     kubernetes_service.save!
 
     # Save info
     project.clusters.create(
-      creation_type: params['creation_type'],
       gcp_project_id: params['gcp_project_id'],
       cluster_zone: params['cluster_zone'],
       cluster_name: params['cluster_name'],
diff --git a/app/models/project_services/kubernetes_service.rb b/app/models/project_services/kubernetes_service.rb
index 8ba07173c74..0f5f9aae93c 100644
--- a/app/models/project_services/kubernetes_service.rb
+++ b/app/models/project_services/kubernetes_service.rb
@@ -15,6 +15,7 @@ class KubernetesService < DeploymentService
   # Bearer authentication
   # TODO:  user/password auth, client certificates
   prop_accessor :token
+  attr_accessor :username, :password
 
   # Provide a custom CA bundle for self-signed deployments
   prop_accessor :ca_pem
@@ -138,6 +139,15 @@ class KubernetesService < DeploymentService
 
   TEMPLATE_PLACEHOLDER = 'Kubernetes namespace'.freeze
 
+  def read_secrets
+    kubeclient = build_kubeclient!
+
+    kubeclient.get_secrets.as_json
+  rescue KubeException => err
+    raise err unless err.error_code == 404
+    []
+  end
+
   private
 
   def kubeconfig
@@ -157,7 +167,7 @@ class KubernetesService < DeploymentService
   end
 
   def build_kubeclient!(api_path: 'api', api_version: 'v1')
-    raise "Incomplete settings" unless api_url && actual_namespace && token
+    raise "Incomplete settings" unless api_url && (token || (username && password))
 
     ::Kubeclient::Client.new(
       join_api_url(api_path),
@@ -190,7 +200,11 @@ class KubernetesService < DeploymentService
   end
 
   def kubeclient_auth_options
-    { bearer_token: token }
+    if token
+      { bearer_token: token }
+    else
+      { username: username, password: password }
+    end
   end
 
   def join_api_url(api_path)
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 8b3c23d5d28..8e664687fc1 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -1,3 +1,4 @@
 Create a new cluster
 %br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation42", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+-# gke-test-creation#{Random.rand(100)}
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 518fcf2530a..79d5ff4b59b 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,3 +1,4 @@
 edit/show cluster
 %br
 = @cluster.inspect
+= @cluster.service.inspect
-- 
cgit v1.2.1


From 1ae29851d0f7e18933029c46d560bbc3adca4357 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 27 Sep 2017 14:17:15 +0100
Subject: Fix karma

---
 app/assets/javascripts/notes/components/issue_comment_form.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index afd58b7ceb7..e37bbe164fe 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -275,7 +275,7 @@
                 :markdown-docs-path="markdownDocsPath"
                 :quick-actions-docs-path="quickActionsDocsPath"
                 :add-spacing-classes="false"
-                :is-confidential-issue="isConfidentialIssue"
+                :is-confidential-issue="isIssueConfidential(getIssueData)"
                 ref="markdownField">
                 <textarea
                   id="note-body"
-- 
cgit v1.2.1


From 058e595788118fb129d3003989a3728de9ae7e39 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 27 Sep 2017 22:17:41 +0900
Subject: Delete/Update basic implementation

---
 app/controllers/projects/clusters_controller.rb | 10 ++++++++--
 app/views/projects/clusters/edit.html.haml      |  3 +++
 config/routes/project.rb                        |  3 +--
 db/migrate/20170924094327_create_ci_clusters.rb |  2 +-
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index b6e2b2a723b..cb753a8b098 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -12,7 +12,7 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def index
     if cluster
-      redirect_to action: 'edit'
+      redirect_to edit_namespace_project_cluster_path(project.namespace, project, cluster.id)
     else
       redirect_to action: 'new'
     end
@@ -86,10 +86,16 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def update
-    cluster.update(schedule_params)
+    cluster.update(enabled: params['enabled'])
+    cluster.service.update(active: params['enabled'])
     render :edit
   end
 
+  def destroy
+    cluster.destroy
+    redirect_to action: 'index'
+  end
+
   private
 
   def cluster
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 79d5ff4b59b..b01b9905ca7 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -2,3 +2,6 @@ edit/show cluster
 %br
 = @cluster.inspect
 = @cluster.service.inspect
+= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'true'), method: :put
+= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'false'), method: :put
+= link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 23c3f87df81..c6dab9a4f33 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -183,10 +183,9 @@ constraints(ProjectUrlConstrainer.new) do
         end
       end
 
-      resources :clusters, except: [:edit, :show, :destroy] do
+      resources :clusters, except: [:show] do
         collection do
           get :login
-          get :edit
         end
       end
 
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index dce3298cde2..c919c5da2c4 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -29,7 +29,7 @@ class CreateCiClusters < ActiveRecord::Migration
       t.datetime_with_timezone :updated_at, null: false
     end
 
-    # TODO: fk, index, encypt
+    # TODO: fk, index, attr_encrypted
 
     add_foreign_key :ci_clusters, :projects
     add_foreign_key :ci_clusters, :users, column: :owner_id
-- 
cgit v1.2.1


From a510d9bdfb3d5a524a62388980cfa0a552bbefb7 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Wed, 27 Sep 2017 15:46:09 +0100
Subject: Correct disabled note form style

---
 .../notes/components/issue_discussion_locked_widget.vue  |  9 +++++++--
 app/assets/stylesheets/pages/note_form.scss              | 16 ++++++++++++++++
 app/views/shared/notes/_notes_with_form.html.haml        | 12 +++++++-----
 3 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
index fa2ff6e5c58..f0429b82aaa 100644
--- a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
+++ b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
@@ -1,6 +1,10 @@
 <script>
   export default {
-    name: 'discussionLockedWidget',
+    computed: {
+      icon() {
+        return gl.utils.spriteIcon('lock');
+      },
+    },
   };
 
 </script>
@@ -8,7 +12,8 @@
 <template>
   <div class="disabled-comment text-center">
     <span class="issuable-note-warning">
-      This issue is locked. Only <b>project members</b> can comment.
+      <span class="icon" v-html="icon"></span>
+      <span>This issue is locked. Only <b>project members</b> can comment.</span>
      </span>
   </div>
 </template>
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index 8b7d42214e6..5b93ff5ce14 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -112,6 +112,22 @@
   align-items: center;
 }
 
+.disabled-comment .issuable-note-warning {
+  border: none;
+  border-radius: $label-border-radius;
+  padding-top: $gl-vert-padding;
+  padding-bottom: $gl-vert-padding;
+
+  .icon svg {
+    position: relative;
+    top: 2px;
+    margin-right: $btn-xs-side-margin;
+    width: $gl-font-size;
+    height: $gl-font-size;
+    fill: $orange-600;
+  }
+}
+
 .sidebar-item-value {
   .fa {
     background-color: inherit;
diff --git a/app/views/shared/notes/_notes_with_form.html.haml b/app/views/shared/notes/_notes_with_form.html.haml
index 7da17e5b6db..c6e18108c7a 100644
--- a/app/views/shared/notes/_notes_with_form.html.haml
+++ b/app/views/shared/notes/_notes_with_form.html.haml
@@ -27,9 +27,11 @@
 - elsif discussion_locked
   .disabled-comment.text-center.prepend-top-default
     %span.issuable-note-warning
-      This
-      = issuable.class.to_s.titleize.downcase
-      is locked. Only
-      %b project members
-      can comment.
+      %span.icon= sprite_icon('lock', size: 14)
+      %span
+        This
+        = issuable.class.to_s.titleize.downcase
+        is locked. Only
+        %b project members
+        can comment.
 %script.js-notes-data{ type: "application/json" }= initial_notes_data(autocomplete).to_json.html_safe
-- 
cgit v1.2.1


From fabc359e77c39aea86f0eaa9f19b17b2a609dd99 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 28 Sep 2017 18:11:17 +0900
Subject: Multithreading cluster creation is done with `reactive_cache`

---
 app/controllers/projects/clusters_controller.rb | 93 ++++++-------------------
 app/models/ci/cluster.rb                        | 78 +++++++++++++++++++++
 app/services/ci/create_cluster_service.rb       | 29 ++++++++
 app/views/projects/clusters/_form.html.haml     |  2 +-
 app/views/projects/clusters/edit.html.haml      |  1 +
 config/routes/project.rb                        |  4 ++
 db/migrate/20170924094327_create_ci_clusters.rb |  1 +
 db/schema.rb                                    |  1 +
 lib/google_api/cloud_platform/client.rb         | 18 ++---
 9 files changed, 141 insertions(+), 86 deletions(-)
 create mode 100644 app/services/ci/create_cluster_service.rb

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index cb753a8b098..f3dd55a6800 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -1,5 +1,5 @@
 class Projects::ClustersController < Projects::ApplicationController
-  before_action :cluster
+  before_action :cluster, except: [:login, :index, :new, :create]
   before_action :authorize_google_api, except: [:login]
   # before_action :authorize_admin_clusters! # TODO: Authentication
 
@@ -11,8 +11,8 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def index
-    if cluster
-      redirect_to edit_namespace_project_cluster_path(project.namespace, project, cluster.id)
+    if project.clusters.any?
+      redirect_to edit_namespace_project_cluster_path(project.namespace, project, project.clusters.last.id)
     else
       redirect_to action: 'new'
     end
@@ -22,72 +22,36 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def create
-    # Create a cluster on GKE
-    operation = api_client.projects_zones_clusters_create(
-      params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
-      cluster_size: params['cluster_size'], machine_type: params['machine_type']
-    )
-
-    # wait_operation_done
-    if operation&.operation_type == 'CREATE_CLUSTER'
-      api_client.wait_operation_done(operation.self_link)
-    else
-      raise "TODO: ERROR"
+    begin
+      Ci::CreateClusterService.new(project, current_user, params)
+                              .create_cluster_on_gke(api_client)
+    rescue Ci::CreateClusterService::UnexpectedOperationError => e
+      puts "#{self.class.name} - #{__callee__}: e: #{e}"
+      # TODO: error
     end
 
-    # Get cluster details (end point, etc)
-    gke_cluster = api_client.projects_zones_clusters_get(
-      params['gcp_project_id'], params['cluster_zone'], params['cluster_name']
-    )
+    redirect_to action: 'index'
+  end
 
-    # Get k8s token
-    token = ''
-    KubernetesService.new.tap do |ks|
-      ks.api_url = 'https://' + gke_cluster.endpoint
-      ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-      ks.username = gke_cluster.master_auth.username
-      ks.password = gke_cluster.master_auth.password
-      secrets = ks.read_secrets
-      secrets.each do |secret|
-        name = secret.dig('metadata', 'name')
-        if /default-token/ =~ name
-          token_base64 = secret.dig('data', 'token')
-          token = Base64.decode64(token_base64)
-          break
-        end
+  ##
+  # Return
+  # @status: The current status of the operation.
+  # @status_message: If an error has occurred, a textual description of the error.
+  def creation_status
+    respond_to do |format|
+      format.json do
+        render json: cluster.creation_status(session[GoogleApi::CloudPlatform::Client.token_in_session])
       end
     end
-
-    # Update service
-    kubernetes_service.attributes = service_params(
-        active: true,
-        api_url: 'https://' + gke_cluster.endpoint,
-        ca_pem: Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate),
-        namespace: params['project_namespace'],
-        token: token
-      )
-
-    kubernetes_service.save!
-
-    # Save info
-    project.clusters.create(
-      gcp_project_id: params['gcp_project_id'],
-      cluster_zone: params['cluster_zone'],
-      cluster_name: params['cluster_name'],
-      service: kubernetes_service
-    )
-
-    redirect_to action: 'index'
   end
 
   def edit
-    # TODO: If on, do we override parameter?
-    # TODO: If off, do we override parameter?
   end
 
   def update
     cluster.update(enabled: params['enabled'])
     cluster.service.update(active: params['enabled'])
+    # TODO: Do we overwrite KubernetesService parameter?
     render :edit
   end
 
@@ -99,8 +63,7 @@ class Projects::ClustersController < Projects::ApplicationController
   private
 
   def cluster
-    # Each project has only one cluster, for now. In the future iteraiton, we'll support multiple clusters
-    @cluster ||= project.clusters.last
+    @cluster ||= project.clusters.find(params[:id])
   end
 
   def api_client
@@ -112,20 +75,6 @@ class Projects::ClustersController < Projects::ApplicationController
       )
   end
 
-  def kubernetes_service
-    @kubernetes_service ||= project.find_or_initialize_service('kubernetes')
-  end
-
-  def service_params(active:, api_url:, ca_pem:, namespace:, token:)
-    {
-      active: active,
-      api_url: api_url,
-      ca_pem: ca_pem,
-      namespace: namespace,
-      token: token
-    }
-  end
-
   def authorize_google_api
     unless session[GoogleApi::CloudPlatform::Client.token_in_session]
       redirect_to action: 'login'
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index 855280ef024..f9a9d12d118 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -1,10 +1,88 @@
 module Ci
   class Cluster < ActiveRecord::Base
     extend Gitlab::Ci::Model
+    include ReactiveCaching
+
+    self.reactive_cache_key = ->(cluster) { [cluster.class.model_name.singular, cluster.project_id, cluster.id] }
 
     belongs_to :project
     belongs_to :owner, class_name: 'User'
     belongs_to :service
 
+    # after_save :clear_reactive_cache!
+
+    def creation_status(access_token)
+      with_reactive_cache(access_token) do |operation|
+        {
+          status: operation[:status],
+          status_message: operation[:status_message]
+        }
+      end
+    end
+
+    def calculate_reactive_cache(access_token)
+      return { status: 'INTEGRATED' } if service # If it's already done, we don't need to continue the following process
+
+      api_client = GoogleApi::CloudPlatform::Client.new(access_token, nil)
+      operation = api_client.projects_zones_operations(gcp_project_id, cluster_zone, gcp_operation_id)
+
+      if operation&.status == 'DONE'
+        # Get cluster details (end point, etc)
+        gke_cluster = api_client.projects_zones_clusters_get(
+          gcp_project_id, cluster_zone, cluster_name
+        )
+
+        # Get k8s token
+        token = ''
+        KubernetesService.new.tap do |ks|
+          ks.api_url = 'https://' + gke_cluster.endpoint
+          ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+          ks.username = gke_cluster.master_auth.username
+          ks.password = gke_cluster.master_auth.password
+          secrets = ks.read_secrets
+          secrets.each do |secret|
+            name = secret.dig('metadata', 'name')
+            if /default-token/ =~ name
+              token_base64 = secret.dig('data', 'token')
+              token = Base64.decode64(token_base64)
+              break
+            end
+          end
+        end
+
+        # k8s endpoint, ca_cert
+        endpoint = 'https://' + gke_cluster.endpoint
+        cluster_ca_certificate = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+
+        # Update service
+        kubernetes_service.attributes = {
+          active: true,
+          api_url: endpoint,
+          ca_pem: cluster_ca_certificate,
+          namespace: project_namespace,
+          token: token
+        }
+
+        kubernetes_service.save!
+
+        # Save info in cluster record
+        update(
+          enabled: true,
+          service: kubernetes_service,
+          username: gke_cluster.master_auth.username,
+          password: gke_cluster.master_auth.password,
+          token: token,
+          ca_cert: cluster_ca_certificate,
+          end_point: endpoint,
+        )
+      end
+
+      puts "#{self.class.name} - #{__callee__}: operation.to_json: #{operation.to_json}"
+      operation.to_h
+    end
+
+    def kubernetes_service
+      @kubernetes_service ||= project.find_or_initialize_service('kubernetes')
+    end
   end
 end
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
new file mode 100644
index 00000000000..bbf42ab2c8d
--- /dev/null
+++ b/app/services/ci/create_cluster_service.rb
@@ -0,0 +1,29 @@
+module Ci
+  class CreateClusterService < BaseService
+    UnexpectedOperationError = Class.new(StandardError)
+
+    def create_cluster_on_gke(api_client)
+      # Create a cluster on GKE
+      operation = api_client.projects_zones_clusters_create(
+        params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
+        cluster_size: params['cluster_size'], machine_type: params['machine_type']
+      )
+
+      if operation&.status != ('RUNNING' || 'PENDING')
+        raise UnexpectedOperationError
+      end
+
+      api_client.parse_self_link(operation.self_link).tap do |project_id, zone, operation_id|
+        project.clusters.create(owner: current_user,
+                                gcp_project_id: params['gcp_project_id'],
+                                cluster_zone: params['cluster_zone'],
+                                cluster_name: params['cluster_name'],
+                                project_namespace: params['project_namespace'],
+                                gcp_operation_id: operation_id).tap do |cluster|
+          # Start status polling. When the operation finish, create KubernetesService.
+          cluster.creation_status(api_client.access_token)
+        end
+      end
+    end
+  end
+end
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 8e664687fc1..8d16f1ceedf 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -1,4 +1,4 @@
 Create a new cluster
 %br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation42", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
+= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
 -# gke-test-creation#{Random.rand(100)}
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index b01b9905ca7..ee7c8896f68 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -5,3 +5,4 @@ edit/show cluster
 = link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'true'), method: :put
 = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'false'), method: :put
 = link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
+= link_to 'Check status', creation_status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), :remote => true
diff --git a/config/routes/project.rb b/config/routes/project.rb
index c6dab9a4f33..396681d272a 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -187,6 +187,10 @@ constraints(ProjectUrlConstrainer.new) do
         collection do
           get :login
         end
+
+        member do
+          get :creation_status, format: :json
+        end
       end
 
       resources :environments, except: [:destroy] do
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index c919c5da2c4..33a67be46dc 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -24,6 +24,7 @@ class CreateCiClusters < ActiveRecord::Migration
       t.string :gcp_project_id
       t.string :cluster_zone
       t.string :cluster_name
+      t.string :gcp_operation_id
 
       t.datetime_with_timezone :created_at, null: false
       t.datetime_with_timezone :updated_at, null: false
diff --git a/db/schema.rb b/db/schema.rb
index 3908f06821e..0ebce995cfd 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -281,6 +281,7 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.string "gcp_project_id"
     t.string "cluster_zone"
     t.string "cluster_name"
+    t.string "gcp_operation_id"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
   end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index f0ca2c52aa7..61176e39464 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -40,7 +40,8 @@ module GoogleApi
         begin
           operation = service.create_cluster(project_id, zone, request_body)
         rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          Rails.logger.error("#{self.class.name}: Could not create cluster #{cluster_name}: #{e}")
+          puts "#{self.class.name} - #{__callee__}: Could not create cluster #{cluster_name}: #{e}"
+          # TODO: Error
         end
         puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
         operation
@@ -51,23 +52,14 @@ module GoogleApi
         service.authorization = access_token
 
         operation = service.get_zone_operation(project_id, zone, operation_id)
+        puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
         operation
       end
 
-      def wait_operation_done(self_link)
-        running = true
-
+      def parse_self_link(self_link)
         ret = self_link.match(/projects\/(.*)\/zones\/(.*)\/operations\/(.*)/)
-        project_id = ret[1]
-        zone = ret[2]
-        operation_id = ret[3]
 
-        while running
-          operation = projects_zones_operations(project_id, zone, operation_id)
-          if operation.status != 'RUNNING'
-            running = false
-          end
-        end
+        return ret[1], ret[2], ret[3] # project_id, zone, operation_id
       end
     end
   end
-- 
cgit v1.2.1


From bda1b0a878205ac99bf10c0b4f0e63f2d4e3a25f Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 29 Sep 2017 00:08:11 +0900
Subject: Databse foreing key, index, encrypt password. Use short path. Improve
 error handling. Polish.

---
 .../google_api/authorizations_controller.rb        |  2 -
 app/controllers/projects/clusters_controller.rb    | 40 ++++++++++----
 app/models/ci/cluster.rb                           | 63 ++++++++++++++--------
 app/services/ci/create_cluster_service.rb          |  4 +-
 db/migrate/20170924094327_create_ci_clusters.rb    | 17 +++---
 db/schema.rb                                       | 15 ++++--
 lib/google_api/cloud_platform/client.rb            | 24 +++++++--
 7 files changed, 110 insertions(+), 55 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 1fafd7e88be..4b315181b7d 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -1,8 +1,6 @@
 module GoogleApi
   class AuthorizationsController < ApplicationController
-    # /google_api/authorizations/callback(.:format)
     def callback
-      # TODO: Error handling
       session[GoogleApi::CloudPlatform::Client.token_in_session] = 
         GoogleApi::Authentication.new(nil, callback_google_api_authorizations_url)
                                  .get_token(params[:code])
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index f3dd55a6800..61bd28c65fe 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -7,14 +7,15 @@ class Projects::ClustersController < Projects::ApplicationController
     begin
       @authorize_url = api_client.authorize_url
     rescue GoogleApi::Authentication::ConfigMissingError
+      # Show an alert message that gitlab.yml is not configured properly
     end
   end
 
   def index
     if project.clusters.any?
-      redirect_to edit_namespace_project_cluster_path(project.namespace, project, project.clusters.last.id)
+      redirect_to edit_project_cluster_path(project, project.clusters.last.id)
     else
-      redirect_to action: 'new'
+      redirect_to new_project_cluster_path(project)
     end
   end
 
@@ -26,11 +27,11 @@ class Projects::ClustersController < Projects::ApplicationController
       Ci::CreateClusterService.new(project, current_user, params)
                               .create_cluster_on_gke(api_client)
     rescue Ci::CreateClusterService::UnexpectedOperationError => e
-      puts "#{self.class.name} - #{__callee__}: e: #{e}"
       # TODO: error
+      puts "#{self.class.name} - #{__callee__}: e: #{e}"
     end
 
-    redirect_to action: 'index'
+    redirect_to project_clusters_path(project)
   end
 
   ##
@@ -49,15 +50,36 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def update
-    cluster.update(enabled: params['enabled'])
-    cluster.service.update(active: params['enabled'])
-    # TODO: Do we overwrite KubernetesService parameter?
+    Ci::Cluster.transaction do
+      if params['enabled'] == 'true'
+
+        cluster.service.attributes = {
+          active: true,
+          api_url: cluster.endpoint,
+          ca_pem: cluster.ca_cert,
+          namespace: cluster.project_namespace,
+          token: cluster.token
+        }
+
+        cluster.service.save!
+      else
+        cluster.service.update(active: false)
+      end
+
+      cluster.update(enabled: params['enabled'])
+    end
+
     render :edit
   end
 
   def destroy
-    cluster.destroy
-    redirect_to action: 'index'
+    if cluster.destroy
+      redirect_to project_clusters_path(project), status: 302
+    else
+      redirect_to project_clusters_path(project),
+                  status: :forbidden,
+                  alert: _("Failed to remove the cluster")
+    end
   end
 
   private
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index f9a9d12d118..afb70a3ff4a 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -6,9 +6,15 @@ module Ci
     self.reactive_cache_key = ->(cluster) { [cluster.class.model_name.singular, cluster.project_id, cluster.id] }
 
     belongs_to :project
-    belongs_to :owner, class_name: 'User'
+    belongs_to :user
     belongs_to :service
 
+    attr_encrypted :password,
+       mode: :per_attribute_iv_and_salt,
+       insecure_mode: true,
+       key: Gitlab::Application.secrets.db_key_base,
+       algorithm: 'aes-256-cbc'
+
     # after_save :clear_reactive_cache!
 
     def creation_status(access_token)
@@ -26,12 +32,16 @@ module Ci
       api_client = GoogleApi::CloudPlatform::Client.new(access_token, nil)
       operation = api_client.projects_zones_operations(gcp_project_id, cluster_zone, gcp_operation_id)
 
-      if operation&.status == 'DONE'
+      return { status_message: 'Failed to get a status' } unless operation
+
+      if operation.status == 'DONE'
         # Get cluster details (end point, etc)
         gke_cluster = api_client.projects_zones_clusters_get(
           gcp_project_id, cluster_zone, cluster_name
         )
 
+        return { status_message: 'Failed to get a cluster info on gke' } unless gke_cluster
+
         # Get k8s token
         token = ''
         KubernetesService.new.tap do |ks|
@@ -50,34 +60,41 @@ module Ci
           end
         end
 
+        return { status_message: 'Failed to get a default token on kubernetes' } unless token
+
         # k8s endpoint, ca_cert
         endpoint = 'https://' + gke_cluster.endpoint
         cluster_ca_certificate = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
 
-        # Update service
-        kubernetes_service.attributes = {
-          active: true,
-          api_url: endpoint,
-          ca_pem: cluster_ca_certificate,
-          namespace: project_namespace,
-          token: token
-        }
+        begin
+          Ci::Cluster.transaction do
+            # Update service
+            kubernetes_service.attributes = {
+              active: true,
+              api_url: endpoint,
+              ca_pem: cluster_ca_certificate,
+              namespace: project_namespace,
+              token: token
+            }
 
-        kubernetes_service.save!
-
-        # Save info in cluster record
-        update(
-          enabled: true,
-          service: kubernetes_service,
-          username: gke_cluster.master_auth.username,
-          password: gke_cluster.master_auth.password,
-          token: token,
-          ca_cert: cluster_ca_certificate,
-          end_point: endpoint,
-        )
+            kubernetes_service.save!
+
+            # Save info in cluster record
+            update(
+              enabled: true,
+              service: kubernetes_service,
+              username: gke_cluster.master_auth.username,
+              password: gke_cluster.master_auth.password,
+              token: token,
+              ca_cert: cluster_ca_certificate,
+              endpoint: endpoint,
+            )
+          end
+        rescue ActiveRecord::RecordInvalid => exception
+          return { status_message: 'Failed to setup integration' }
+        end
       end
 
-      puts "#{self.class.name} - #{__callee__}: operation.to_json: #{operation.to_json}"
       operation.to_h
     end
 
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index bbf42ab2c8d..edae245ec38 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -10,11 +10,11 @@ module Ci
       )
 
       if operation&.status != ('RUNNING' || 'PENDING')
-        raise UnexpectedOperationError
+        raise UnexpectedOperationError.new(operation&.status_message)
       end
 
       api_client.parse_self_link(operation.self_link).tap do |project_id, zone, operation_id|
-        project.clusters.create(owner: current_user,
+        project.clusters.create(user: current_user,
                                 gcp_project_id: params['gcp_project_id'],
                                 cluster_zone: params['cluster_zone'],
                                 cluster_name: params['cluster_name'],
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index 33a67be46dc..2663130c7e6 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -3,9 +3,9 @@ class CreateCiClusters < ActiveRecord::Migration
 
   def up
     create_table :ci_clusters do |t|
-      t.integer :project_id
-      t.integer :owner_id
-      t.integer :service_id
+      t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
+      t.references :user, null: false, foreign_key: true
+      t.references :service, foreign_key: true
 
       # General
       t.boolean :enabled, default: true
@@ -14,11 +14,14 @@ class CreateCiClusters < ActiveRecord::Migration
       t.string :project_namespace
 
       # Cluster details
-      t.string :end_point
+      t.string :endpoint
       t.text :ca_cert
       t.string :token
       t.string :username
       t.string :password
+      t.string :encrypted_password
+      t.string :encrypted_password_salt
+      t.string :encrypted_password_iv
 
       # GKE
       t.string :gcp_project_id
@@ -29,12 +32,6 @@ class CreateCiClusters < ActiveRecord::Migration
       t.datetime_with_timezone :created_at, null: false
       t.datetime_with_timezone :updated_at, null: false
     end
-
-    # TODO: fk, index, attr_encrypted
-
-    add_foreign_key :ci_clusters, :projects
-    add_foreign_key :ci_clusters, :users, column: :owner_id
-    add_foreign_key :ci_clusters, :services
   end
 
   def down
diff --git a/db/schema.rb b/db/schema.rb
index 0ebce995cfd..af5367113a2 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -268,16 +268,19 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_index "ci_builds", ["user_id"], name: "index_ci_builds_on_user_id", using: :btree
 
   create_table "ci_clusters", force: :cascade do |t|
-    t.integer "project_id"
-    t.integer "owner_id"
+    t.integer "project_id", null: false
+    t.integer "user_id", null: false
     t.integer "service_id"
     t.boolean "enabled", default: true
     t.string "project_namespace"
-    t.string "end_point"
+    t.string "endpoint"
     t.text "ca_cert"
     t.string "token"
     t.string "username"
     t.string "password"
+    t.string "encrypted_password"
+    t.string "encrypted_password_salt"
+    t.string "encrypted_password_iv"
     t.string "gcp_project_id"
     t.string "cluster_zone"
     t.string "cluster_name"
@@ -286,6 +289,8 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.datetime "updated_at", null: false
   end
 
+  add_index "ci_clusters", ["project_id"], name: "index_ci_clusters_on_project_id", unique: true, using: :btree
+
   create_table "ci_group_variables", force: :cascade do |t|
     t.string "key", null: false
     t.text "value"
@@ -1704,9 +1709,9 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_foreign_key "ci_builds", "ci_pipelines", column: "auto_canceled_by_id", name: "fk_a2141b1522", on_delete: :nullify
   add_foreign_key "ci_builds", "ci_stages", column: "stage_id", name: "fk_3a9eaa254d", on_delete: :cascade
   add_foreign_key "ci_builds", "projects", name: "fk_befce0568a", on_delete: :cascade
-  add_foreign_key "ci_clusters", "projects"
+  add_foreign_key "ci_clusters", "projects", on_delete: :cascade
   add_foreign_key "ci_clusters", "services"
-  add_foreign_key "ci_clusters", "users", column: "owner_id"
+  add_foreign_key "ci_clusters", "users"
   add_foreign_key "ci_group_variables", "namespaces", column: "group_id", name: "fk_33ae4d58d8", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedule_variables", "ci_pipeline_schedules", column: "pipeline_schedule_id", name: "fk_41c35fda51", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedules", "projects", name: "fk_8ead60fcc4", on_delete: :cascade
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 61176e39464..0bc306a24e6 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -13,11 +13,22 @@ module GoogleApi
         'https://www.googleapis.com/auth/cloud-platform'
       end
 
+      ##
+      # Exception
+      # Google::Apis::ClientError:
+      # Google::Apis::AuthorizationError:
+      ##
+
       def projects_zones_clusters_get(project_id, zone, cluster_id)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
-        cluster = service.get_zone_cluster(project_id, zone, cluster_id)
+        begin
+          cluster = service.get_zone_cluster(project_id, zone, cluster_id)
+        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+          return nil
+        end
+
         puts "#{self.class.name} - #{__callee__}: cluster: #{cluster.inspect}"
         cluster
       end
@@ -40,9 +51,9 @@ module GoogleApi
         begin
           operation = service.create_cluster(project_id, zone, request_body)
         rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          puts "#{self.class.name} - #{__callee__}: Could not create cluster #{cluster_name}: #{e}"
-          # TODO: Error
+          return nil
         end
+
         puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
         operation
       end
@@ -51,7 +62,12 @@ module GoogleApi
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
-        operation = service.get_zone_operation(project_id, zone, operation_id)
+        begin
+          operation = service.get_zone_operation(project_id, zone, operation_id)
+        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+          return nil
+        end
+
         puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
         operation
       end
-- 
cgit v1.2.1


From fe96bd416c0556cac5da7a178264340798a74fbf Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Fri, 29 Sep 2017 18:31:09 +0100
Subject: Fix md-area top border-radius with issue issuable-note-warning

---
 app/assets/javascripts/notes/components/issue_comment_form.vue | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index e37bbe164fe..3682c95f6eb 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -263,13 +263,14 @@
               class="new-note js-quick-submit common-note-form gfm-form js-main-target-form"
             >
 
+              <div class="error-alert"></div>
+
               <issue-warning
                 v-if="hasIssueWarning(getIssueData)"
                 :is-locked="isIssueLocked(getIssueData)"
                 :is-confidential="isIssueConfidential(getIssueData)"
               />
 
-              <div class="error-alert"></div>
               <markdown-field
                 :markdown-preview-path="markdownPreviewPath"
                 :markdown-docs-path="markdownDocsPath"
-- 
cgit v1.2.1


From c30546f4aa073f44e97b49f47c57a9a89062c3c6 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Fri, 29 Sep 2017 19:56:03 +0100
Subject: Adds login page, sidebar, header and form

---
 .../images/auth_buttons/signin_with_google.png     | Bin 0 -> 3983 bytes
 app/views/projects/clusters/_form.html.haml        |  39 ++++++++++++++++++---
 app/views/projects/clusters/_header.html.haml      |  15 ++++++++
 app/views/projects/clusters/_sidebar.html.haml     |   8 +++++
 app/views/projects/clusters/login.html.haml        |  16 +++++----
 app/views/projects/clusters/new.html.haml          |   7 ++--
 6 files changed, 72 insertions(+), 13 deletions(-)
 create mode 100644 app/assets/images/auth_buttons/signin_with_google.png
 create mode 100644 app/views/projects/clusters/_header.html.haml
 create mode 100644 app/views/projects/clusters/_sidebar.html.haml

diff --git a/app/assets/images/auth_buttons/signin_with_google.png b/app/assets/images/auth_buttons/signin_with_google.png
new file mode 100644
index 00000000000..b1327b4f7b4
Binary files /dev/null and b/app/assets/images/auth_buttons/signin_with_google.png differ
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 8d16f1ceedf..cf1a087ed13 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -1,4 +1,35 @@
-Create a new cluster
-%br
-= link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
--# gke-test-creation#{Random.rand(100)}
+.row
+  .col-sm-8.col-sm-offset-4
+    %p
+      -link_to_help_page = link_to(s_('ClusterIntegration|help page'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
+      = s_('ClusterIntegration|Use our %{link_to_help_page} on cluster integration.').html_safe % { link_to_help_page: link_to_help_page}
+
+      = form_for 'cluster' do |field|
+        .form-group
+          = field.label :cluster_name
+          = field.text_field :cluster_name, class: 'form-control'
+
+        .form-group
+          = field.label :gcp_project_id
+          = field.text_field :gcp_project_id, class: 'form-control'
+
+        .form-group
+          = field.label :cluster_zone
+          = field.text_field :cluster_zone, class: 'form-control'
+
+        .form-group
+          = field.label :cluster_size
+          = field.text_field :cluster_size, class: 'form-control'
+
+        .form-group
+          = field.label :project_namespace
+          = field.text_field :project_namespace, class: 'form-control'
+
+        .form-group
+          = field.label :machine_type
+          = field.text_field :machine_type, class: 'form-control'
+
+        .form-group
+          = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
+
+          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
\ No newline at end of file
diff --git a/app/views/projects/clusters/_header.html.haml b/app/views/projects/clusters/_header.html.haml
new file mode 100644
index 00000000000..52a123d603e
--- /dev/null
+++ b/app/views/projects/clusters/_header.html.haml
@@ -0,0 +1,15 @@
+.col-lg-8
+  %h4.prepend-top-0
+    = s_('ClusterIntegration|Create new cluster on Google Container Engine')
+  %p
+    = s_('ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:')
+  %ul
+    %li
+      - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'))
+      = s_('ClusterIntegration|Your account must have %{link_to_container_engine}').html_safe % { link_to_container_engine: link_to_container_engine }
+      %li
+        - link_to_requirements = link_to(s_('ClusterIntegration|meets the requirements'))
+        = s_('ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters').html_safe % { link_to_requirements: link_to_requirements }
+      %li
+        - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'))
+        = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
\ No newline at end of file
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
new file mode 100644
index 00000000000..f2f9e04f80e
--- /dev/null
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -0,0 +1,8 @@
+.col-sm-4
+  %h4.prepend-top-0
+    = s_('ClusterIntegration|Cluster integration')
+  %p
+    = s_('ClusterIntegration|With cluster integration you can take advantage of Kubernetes auto deployment.')
+  %p
+    - link = link_to(s_('ClusterIntegration|auto deployment'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
+    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab').html_safe % { link_to_documentation: link }
\ No newline at end of file
diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
index ddc909d12ca..ef6efc84ceb 100644
--- a/app/views/projects/clusters/login.html.haml
+++ b/app/views/projects/clusters/login.html.haml
@@ -1,6 +1,10 @@
-Login
-%br
-- if @authorize_url
-  = link_to("authenticate from here", @authorize_url)
-- else
-  You have not configrued GitLab properly. So we can not proceed authentication. Please check if you have set up omniauth->providers->google_oauth2 in gitlab.yml
+.row.prepend-top-default
+  = render 'sidebar'
+  = render 'header'
+.row
+  .col-sm-8.col-sm-offset-4
+    - if @authorize_url
+      %a{ href: @authorize_url }
+        = image_tag('auth_buttons/signin_with_google.png')
+    -# - else
+    -#   You have not configrued GitLab properly. So we can not proceed authentication. Please check if you have set up omniauth->providers->google_oauth2 in gitlab.yml
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index 7433f6759a0..e1ff4c6136e 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -1,3 +1,4 @@
-Create a cluster
-%br
-= render "form"
+.row.prepend-top-default
+  = render 'sidebar'
+  = render 'header'
+= render 'form'
-- 
cgit v1.2.1


From e499c1c39dbea505858874ee47436641df3d93d4 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Sun, 1 Oct 2017 00:54:22 +0900
Subject: Replace reactive_cache by multipel sidekiq workers

---
 .../google_api/authorizations_controller.rb        |   6 +-
 app/controllers/projects/clusters_controller.rb    |  84 +++++++-------
 app/models/ci/cluster.rb                           | 122 ++++++---------------
 app/services/ci/create_cluster_service.rb          |  29 +----
 app/services/ci/integrate_cluster_service.rb       |  36 ++++++
 app/services/ci/update_cluster_service.rb          |  26 +++++
 app/views/projects/clusters/_form.html.haml        |   5 +-
 app/views/projects/clusters/edit.html.haml         |  16 ++-
 app/workers/cluster_creation_worker.rb             |  47 ++++++++
 app/workers/wait_for_cluster_creation_worker.rb    |  85 ++++++++++++++
 config/routes/project.rb                           |   2 +-
 config/sidekiq_queues.yml                          |   2 +
 db/migrate/20170924094327_create_ci_clusters.rb    |  12 +-
 db/schema.rb                                       |  12 +-
 lib/google_api/auth.rb                             |  53 +++++++++
 lib/google_api/authentication.rb                   |  53 ---------
 lib/google_api/cloud_platform/client.rb            |  28 ++---
 17 files changed, 376 insertions(+), 242 deletions(-)
 create mode 100644 app/services/ci/integrate_cluster_service.rb
 create mode 100644 app/services/ci/update_cluster_service.rb
 create mode 100644 app/workers/cluster_creation_worker.rb
 create mode 100644 app/workers/wait_for_cluster_creation_worker.rb
 create mode 100644 lib/google_api/auth.rb
 delete mode 100644 lib/google_api/authentication.rb

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 4b315181b7d..00b0c128711 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -1,9 +1,9 @@
 module GoogleApi
   class AuthorizationsController < ApplicationController
     def callback
-      session[GoogleApi::CloudPlatform::Client.token_in_session] = 
-        GoogleApi::Authentication.new(nil, callback_google_api_authorizations_url)
-                                 .get_token(params[:code])
+      session[GoogleApi::CloudPlatform::Client.session_key_for_token] =
+        GoogleApi::CloudPlatform::Client.new(nil, callback_google_api_authorizations_url)
+                                        .get_token(params[:code])
 
       if params[:state]
         redirect_to params[:state]
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 61bd28c65fe..840c623e778 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -1,12 +1,17 @@
 class Projects::ClustersController < Projects::ApplicationController
   before_action :cluster, except: [:login, :index, :new, :create]
   before_action :authorize_google_api, except: [:login]
+  # before_action :cluster_creation_lock, only: [:update, :destroy]
   # before_action :authorize_admin_clusters! # TODO: Authentication
 
   def login
     begin
-      @authorize_url = api_client.authorize_url
-    rescue GoogleApi::Authentication::ConfigMissingError
+      @authorize_url = GoogleApi::CloudPlatform::Client.new(
+          nil,
+          callback_google_api_authorizations_url,
+          state: namespace_project_clusters_url.to_s
+        ).authorize_url
+    rescue GoogleApi::Auth::ConfigMissingError
       # Show an alert message that gitlab.yml is not configured properly
     end
   end
@@ -20,28 +25,29 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def new
+    @cluster = project.clusters.new
   end
 
   def create
-    begin
-      Ci::CreateClusterService.new(project, current_user, params)
-                              .create_cluster_on_gke(api_client)
-    rescue Ci::CreateClusterService::UnexpectedOperationError => e
-      # TODO: error
-      puts "#{self.class.name} - #{__callee__}: e: #{e}"
-    end
+    @cluster = Ci::CreateClusterService
+      .new(project, current_user, cluster_params)
+      .execute(token_in_session)
 
-    redirect_to project_clusters_path(project)
+    if @cluster.persisted?
+      ClusterCreationWorker.perform_async(@cluster.id)
+      redirect_to project_clusters_path(project)
+    else
+      render :new
+    end
   end
 
-  ##
-  # Return
-  # @status: The current status of the operation.
-  # @status_message: If an error has occurred, a textual description of the error.
-  def creation_status
+  def status
     respond_to do |format|
       format.json do
-        render json: cluster.creation_status(session[GoogleApi::CloudPlatform::Client.token_in_session])
+        render json: {
+          status: cluster.status, # The current status of the operation.
+          status_reason: cluster.status_reason # If an error has occurred, a textual description of the error.
+        }
       end
     end
   end
@@ -50,24 +56,9 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def update
-    Ci::Cluster.transaction do
-      if params['enabled'] == 'true'
-
-        cluster.service.attributes = {
-          active: true,
-          api_url: cluster.endpoint,
-          ca_pem: cluster.ca_cert,
-          namespace: cluster.project_namespace,
-          token: cluster.token
-        }
-
-        cluster.service.save!
-      else
-        cluster.service.update(active: false)
-      end
-
-      cluster.update(enabled: params['enabled'])
-    end
+    Ci::UpdateClusterService
+      .new(project, current_user, cluster_params)
+      .execute(cluster)
 
     render :edit
   end
@@ -88,18 +79,27 @@ class Projects::ClustersController < Projects::ApplicationController
     @cluster ||= project.clusters.find(params[:id])
   end
 
-  def api_client
-    @api_client ||=
-      GoogleApi::CloudPlatform::Client.new(
-        session[GoogleApi::CloudPlatform::Client.token_in_session],
-        callback_google_api_authorizations_url,
-        state: namespace_project_clusters_url.to_s
-      )
+  def cluster_params
+    params.require(:cluster)
+      .permit(:gcp_project_id, :cluster_zone, :cluster_name, :cluster_size,
+              :machine_type, :project_namespace, :enabled)
   end
 
   def authorize_google_api
-    unless session[GoogleApi::CloudPlatform::Client.token_in_session]
+    unless token_in_session
       redirect_to action: 'login'
     end
   end
+
+  def token_in_session
+    @token_in_session ||= session[GoogleApi::CloudPlatform::Client.session_key_for_token]
+  end
+
+  def cluster_creation_lock
+    if cluster.on_creation?
+      redirect_to edit_project_cluster_path(project, cluster),
+                  status: :forbidden,
+                  alert: _("You can not modify cluster during creation")
+    end
+  end
 end
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index afb70a3ff4a..d1b69c19965 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -1,105 +1,45 @@
 module Ci
   class Cluster < ActiveRecord::Base
     extend Gitlab::Ci::Model
-    include ReactiveCaching
-
-    self.reactive_cache_key = ->(cluster) { [cluster.class.model_name.singular, cluster.project_id, cluster.id] }
 
     belongs_to :project
     belongs_to :user
     belongs_to :service
 
     attr_encrypted :password,
-       mode: :per_attribute_iv_and_salt,
-       insecure_mode: true,
-       key: Gitlab::Application.secrets.db_key_base,
-       algorithm: 'aes-256-cbc'
-
-    # after_save :clear_reactive_cache!
-
-    def creation_status(access_token)
-      with_reactive_cache(access_token) do |operation|
-        {
-          status: operation[:status],
-          status_message: operation[:status_message]
-        }
-      end
-    end
-
-    def calculate_reactive_cache(access_token)
-      return { status: 'INTEGRATED' } if service # If it's already done, we don't need to continue the following process
-
-      api_client = GoogleApi::CloudPlatform::Client.new(access_token, nil)
-      operation = api_client.projects_zones_operations(gcp_project_id, cluster_zone, gcp_operation_id)
-
-      return { status_message: 'Failed to get a status' } unless operation
-
-      if operation.status == 'DONE'
-        # Get cluster details (end point, etc)
-        gke_cluster = api_client.projects_zones_clusters_get(
-          gcp_project_id, cluster_zone, cluster_name
-        )
-
-        return { status_message: 'Failed to get a cluster info on gke' } unless gke_cluster
-
-        # Get k8s token
-        token = ''
-        KubernetesService.new.tap do |ks|
-          ks.api_url = 'https://' + gke_cluster.endpoint
-          ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-          ks.username = gke_cluster.master_auth.username
-          ks.password = gke_cluster.master_auth.password
-          secrets = ks.read_secrets
-          secrets.each do |secret|
-            name = secret.dig('metadata', 'name')
-            if /default-token/ =~ name
-              token_base64 = secret.dig('data', 'token')
-              token = Base64.decode64(token_base64)
-              break
-            end
-          end
-        end
-
-        return { status_message: 'Failed to get a default token on kubernetes' } unless token
-
-        # k8s endpoint, ca_cert
-        endpoint = 'https://' + gke_cluster.endpoint
-        cluster_ca_certificate = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-
-        begin
-          Ci::Cluster.transaction do
-            # Update service
-            kubernetes_service.attributes = {
-              active: true,
-              api_url: endpoint,
-              ca_pem: cluster_ca_certificate,
-              namespace: project_namespace,
-              token: token
-            }
-
-            kubernetes_service.save!
-
-            # Save info in cluster record
-            update(
-              enabled: true,
-              service: kubernetes_service,
-              username: gke_cluster.master_auth.username,
-              password: gke_cluster.master_auth.password,
-              token: token,
-              ca_cert: cluster_ca_certificate,
-              endpoint: endpoint,
-            )
-          end
-        rescue ActiveRecord::RecordInvalid => exception
-          return { status_message: 'Failed to setup integration' }
-        end
-      end
-
-      operation.to_h
+      mode: :per_attribute_iv_and_salt,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    attr_encrypted :kubernetes_token,
+      mode: :per_attribute_iv_and_salt,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    attr_encrypted :gcp_token,
+      mode: :per_attribute_iv_and_salt,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    enum status: {
+      unknown: nil,
+      scheduled: 1,
+      creating: 2,
+      created: 3,
+      errored: 4
+    }
+
+    def error!(reason)
+      update!(status: statuses[:errored],
+              status_reason: reason,
+              gcp_token: nil)
     end
 
-    def kubernetes_service
-      @kubernetes_service ||= project.find_or_initialize_service('kubernetes')
+    def on_creation?
+      scheduled? || creating?
     end
   end
 end
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index edae245ec38..86820706831 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -1,29 +1,10 @@
 module Ci
   class CreateClusterService < BaseService
-    UnexpectedOperationError = Class.new(StandardError)
-
-    def create_cluster_on_gke(api_client)
-      # Create a cluster on GKE
-      operation = api_client.projects_zones_clusters_create(
-        params['gcp_project_id'], params['cluster_zone'], params['cluster_name'],
-        cluster_size: params['cluster_size'], machine_type: params['machine_type']
-      )
-
-      if operation&.status != ('RUNNING' || 'PENDING')
-        raise UnexpectedOperationError.new(operation&.status_message)
-      end
-
-      api_client.parse_self_link(operation.self_link).tap do |project_id, zone, operation_id|
-        project.clusters.create(user: current_user,
-                                gcp_project_id: params['gcp_project_id'],
-                                cluster_zone: params['cluster_zone'],
-                                cluster_name: params['cluster_name'],
-                                project_namespace: params['project_namespace'],
-                                gcp_operation_id: operation_id).tap do |cluster|
-          # Start status polling. When the operation finish, create KubernetesService.
-          cluster.creation_status(api_client.access_token)
-        end
-      end
+    def execute(access_token)
+      project.clusters.create(
+        params.merge(user: current_user,
+                     status: Ci::Cluster.statuses[:scheduled],
+                     gcp_token: access_token))
     end
   end
 end
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
new file mode 100644
index 00000000000..d5b1ccd345d
--- /dev/null
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -0,0 +1,36 @@
+module Ci
+  class IntegrateClusterService
+    def execute(cluster, endpoint, ca_cert, token, username, password)
+      kubernetes_service ||= cluster.project.find_or_initialize_service('kubernetes')
+
+      Ci::Cluster.transaction do
+        # Update service
+        kubernetes_service.attributes = {
+          active: true,
+          api_url: endpoint,
+          ca_pem: ca_cert,
+          namespace: cluster.project_namespace,
+          token: token
+        }
+
+        kubernetes_service.save!
+
+        # Save info in cluster record
+        cluster.update!(
+          enabled: true,
+          service: kubernetes_service,
+          username: username,
+          password: password,
+          kubernetes_token: token,
+          ca_cert: ca_cert,
+          endpoint: endpoint,
+          gcp_token: nil,
+          status: Ci::Cluster.statuses[:created]
+        )
+      end
+
+    rescue ActiveRecord::RecordInvalid => e
+      cluster.error!("Failed to integrate cluster into kubernetes_service: #{e.message}")
+    end
+  end
+end
diff --git a/app/services/ci/update_cluster_service.rb b/app/services/ci/update_cluster_service.rb
new file mode 100644
index 00000000000..0b458e27b90
--- /dev/null
+++ b/app/services/ci/update_cluster_service.rb
@@ -0,0 +1,26 @@
+module Ci
+  class UpdateClusterService < BaseService
+    def execute(cluster)
+      Ci::Cluster.transaction do
+        if params['enabled'] == 'true'
+
+          cluster.service.attributes = {
+            active: true,
+            api_url: cluster.endpoint,
+            ca_pem: cluster.ca_cert,
+            namespace: cluster.project_namespace,
+            token: cluster.kubernetes_token
+          }
+
+          cluster.service.save!
+        else
+          cluster.service.update(active: false)
+        end
+
+        cluster.update!(enabled: params['enabled'])
+      end
+    rescue ActiveRecord::RecordInvalid => e
+      cluster.errors.add(:base, e.message)
+    end
+  end
+end
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index cf1a087ed13..10a4b4d8ba8 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -4,7 +4,7 @@
       -link_to_help_page = link_to(s_('ClusterIntegration|help page'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
       = s_('ClusterIntegration|Use our %{link_to_help_page} on cluster integration.').html_safe % { link_to_help_page: link_to_help_page}
 
-      = form_for 'cluster' do |field|
+      = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
         .form-group
           = field.label :cluster_name
           = field.text_field :cluster_name, class: 'form-control'
@@ -32,4 +32,5 @@
         .form-group
           = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
 
-          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'), method: :post
\ No newline at end of file
+          -# TODO: Remove before merge
+          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'}), method: :post
\ No newline at end of file
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index ee7c8896f68..7f8400d9ea1 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -2,7 +2,15 @@ edit/show cluster
 %br
 = @cluster.inspect
 = @cluster.service.inspect
-= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'true'), method: :put
-= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, enabled: 'false'), method: :put
-= link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
-= link_to 'Check status', creation_status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), :remote => true
+- unless @cluster.on_creation?
+  = link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'true'}), method: :put
+  = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
+  = link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
+-# status GET
+-# status: The current status of the operation.
+-# status_reason: If an error has occurred, a textual description of the error.
+= link_to 'Check status', status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), :remote => true
+-# simply rendering error, if it happened
+- if @cluster.status_reason
+  %p= status_reason
+-# Even if we got an error during the creation process, we don't delete cluster objects automatically, because we don't have a method to delete the cluster on gke. So users move to edit page from new page **regardless of validation errors**, and they have to delete the record manually. This is for giving users headsup that a new cluster might remain in gke. /cc @ayufan
diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
new file mode 100644
index 00000000000..0b547089b94
--- /dev/null
+++ b/app/workers/cluster_creation_worker.rb
@@ -0,0 +1,47 @@
+class ClusterCreationWorker
+  include Sidekiq::Worker
+  include DedicatedSidekiqQueue
+
+  def perform(cluster_id)
+    cluster = Ci::Cluster.find_by_id(cluster_id)
+
+    unless cluster
+      return Rails.logger.error "Cluster object is not found; #{cluster_id}"
+    end
+
+    api_client =
+      GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+    operation = api_client.projects_zones_clusters_create(
+        cluster.gcp_project_id,
+        cluster.cluster_zone,
+        cluster.cluster_name,
+        cluster.cluster_size,
+        machine_type: cluster.machine_type
+      )
+
+    if operation.is_a?(StandardError)
+      return cluster.error!("Failed to request to CloudPlatform; #{operation.message}")
+    end
+      
+    unless operation.status == 'RUNNING' || operation.status == 'PENDING'
+      return cluster.error!("Operation status is unexpected; #{operation.status_message}")
+    end
+
+    operation_id = api_client.parse_operation_id(operation.self_link)
+
+    unless operation_id
+      return cluster.error!('Can not find operation_id from self_link')
+    end
+
+    if cluster.update(status: Ci::Cluster.statuses[:creating],
+                      gcp_operation_id: operation_id)
+      WaitForClusterCreationWorker.perform_in(
+        WaitForClusterCreationWorker::INITIAL_INTERVAL,
+        cluster.id
+      )
+    else
+      return cluster.error!("Failed to update cluster record; #{cluster.errors}")
+    end
+  end
+end
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
new file mode 100644
index 00000000000..e0dce5a60cd
--- /dev/null
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -0,0 +1,85 @@
+class WaitForClusterCreationWorker
+  include Sidekiq::Worker
+  include DedicatedSidekiqQueue
+
+  INITIAL_INTERVAL = 2.minutes
+  EAGER_INTERVAL = 10.seconds
+  TIMEOUT = 20.minutes
+
+  def perform(cluster_id)
+    cluster = Ci::Cluster.find_by_id(cluster_id)
+
+    unless cluster
+      return Rails.logger.error "Cluster object is not found; #{cluster_id}"
+    end
+
+    api_client = 
+      GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+    operation = api_client.projects_zones_operations(
+        cluster.gcp_project_id,
+        cluster.cluster_zone,
+        cluster.gcp_operation_id
+      )
+
+    if operation.is_a?(StandardError)
+      return cluster.error!("Failed to request to CloudPlatform; #{operation.message}")
+    end
+
+    case operation.status
+    when 'DONE'
+      integrate(api_client, cluster)
+    when 'RUNNING'
+      if Time.now < operation.start_time.to_time + TIMEOUT
+        WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
+      else
+        return cluster.error!("Cluster creation time exceeds timeout; #{TIMEOUT}")
+      end
+    else
+      return cluster.error!("Unexpected operation status; #{operation.status_message}")
+    end
+  end
+
+  def integrate(api_client, cluster)
+    # Get cluster details (end point, etc)
+    gke_cluster = api_client.projects_zones_clusters_get(
+        cluster.gcp_project_id,
+        cluster.cluster_zone,
+        cluster.cluster_name
+      )
+
+    if gke_cluster.is_a?(StandardError)
+      return cluster.error!("Failed to request to CloudPlatform; #{gke_cluster.message}")
+    end
+
+    # Get k8s token
+    kubernetes_token = ''
+    KubernetesService.new.tap do |ks|
+      ks.api_url = 'https://' + gke_cluster.endpoint
+      ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+      ks.username = gke_cluster.master_auth.username
+      ks.password = gke_cluster.master_auth.password
+      secrets = ks.read_secrets
+      secrets.each do |secret|
+        name = secret.dig('metadata', 'name')
+        if /default-token/ =~ name
+          token_base64 = secret.dig('data', 'token')
+          kubernetes_token = Base64.decode64(token_base64)
+          break
+        end
+      end
+    end
+
+    unless kubernetes_token
+      return cluster.error!('Failed to get a default token of kubernetes')
+    end
+
+    # k8s endpoint, ca_cert
+    endpoint = 'https://' + gke_cluster.endpoint
+    ca_cert = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+    username = gke_cluster.master_auth.username
+    password = gke_cluster.master_auth.password
+
+    Ci::IntegrateClusterService.new.execute(cluster, endpoint, ca_cert, kubernetes_token, username, password)
+  end
+end
diff --git a/config/routes/project.rb b/config/routes/project.rb
index 396681d272a..a01e26b2fe3 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -189,7 +189,7 @@ constraints(ProjectUrlConstrainer.new) do
         end
 
         member do
-          get :creation_status, format: :json
+          get :status, format: :json
         end
       end
 
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index d169c38a693..1af90d0a361 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -62,3 +62,5 @@
   - [update_user_activity, 1]
   - [propagate_service_template, 1]
   - [background_migration, 1]
+  - [cluster_creation, 1]
+  - [wait_for_cluster_creation, 1]
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index 2663130c7e6..798c8e03b37 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -9,6 +9,8 @@ class CreateCiClusters < ActiveRecord::Migration
 
       # General
       t.boolean :enabled, default: true
+      t.integer :status
+      t.string :status_reason
 
       # k8s integration specific
       t.string :project_namespace
@@ -16,9 +18,10 @@ class CreateCiClusters < ActiveRecord::Migration
       # Cluster details
       t.string :endpoint
       t.text :ca_cert
-      t.string :token
+      t.string :encrypted_kubernetes_token
+      t.string :encrypted_kubernetes_token_salt
+      t.string :encrypted_kubernetes_token_iv
       t.string :username
-      t.string :password
       t.string :encrypted_password
       t.string :encrypted_password_salt
       t.string :encrypted_password_iv
@@ -27,7 +30,12 @@ class CreateCiClusters < ActiveRecord::Migration
       t.string :gcp_project_id
       t.string :cluster_zone
       t.string :cluster_name
+      t.string :cluster_size
+      t.string :machine_type
       t.string :gcp_operation_id
+      t.string :encrypted_gcp_token
+      t.string :encrypted_gcp_token_salt
+      t.string :encrypted_gcp_token_iv
 
       t.datetime_with_timezone :created_at, null: false
       t.datetime_with_timezone :updated_at, null: false
diff --git a/db/schema.rb b/db/schema.rb
index af5367113a2..de844583d56 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -272,19 +272,27 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.integer "user_id", null: false
     t.integer "service_id"
     t.boolean "enabled", default: true
+    t.integer "status"
+    t.string "status_reason"
     t.string "project_namespace"
     t.string "endpoint"
     t.text "ca_cert"
-    t.string "token"
+    t.string "encrypted_kubernetes_token"
+    t.string "encrypted_kubernetes_token_salt"
+    t.string "encrypted_kubernetes_token_iv"
     t.string "username"
-    t.string "password"
     t.string "encrypted_password"
     t.string "encrypted_password_salt"
     t.string "encrypted_password_iv"
     t.string "gcp_project_id"
     t.string "cluster_zone"
     t.string "cluster_name"
+    t.string "cluster_size"
+    t.string "machine_type"
     t.string "gcp_operation_id"
+    t.string "encrypted_gcp_token"
+    t.string "encrypted_gcp_token_salt"
+    t.string "encrypted_gcp_token_iv"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
   end
diff --git a/lib/google_api/auth.rb b/lib/google_api/auth.rb
new file mode 100644
index 00000000000..92787b87ac6
--- /dev/null
+++ b/lib/google_api/auth.rb
@@ -0,0 +1,53 @@
+module GoogleApi
+  class Auth
+    attr_reader :access_token, :redirect_uri, :state
+
+    ConfigMissingError = Class.new(StandardError)
+
+    def initialize(access_token, redirect_uri, state: nil)
+      @access_token = access_token
+      @redirect_uri = redirect_uri
+      @state = state
+    end
+
+    def authorize_url
+      client.auth_code.authorize_url(
+        redirect_uri: redirect_uri,
+        scope: scope,
+        state: state # This is used for arbitary redirection
+      )
+    end
+
+    def get_token(code)
+      client.auth_code.get_token(code, redirect_uri: redirect_uri).token
+    end
+
+    protected
+
+    def scope
+      raise NotImplementedError
+    end
+
+    private
+
+    def config
+      Gitlab.config.omniauth.providers.find { |provider| provider.name == "google_oauth2" }
+    end
+
+    def client
+      return @client if defined?(@client)
+
+      unless config
+        raise ConfigMissingError
+      end
+
+      @client = ::OAuth2::Client.new(
+        config.app_id,
+        config.app_secret,
+        site: 'https://accounts.google.com',
+        token_url: '/o/oauth2/token', 
+        authorize_url: '/o/oauth2/auth'
+      )
+    end
+  end
+end
diff --git a/lib/google_api/authentication.rb b/lib/google_api/authentication.rb
deleted file mode 100644
index 4c9016e1085..00000000000
--- a/lib/google_api/authentication.rb
+++ /dev/null
@@ -1,53 +0,0 @@
-module GoogleApi
-  class Authentication
-    attr_reader :access_token, :redirect_uri, :state
-
-    ConfigMissingError = Class.new(StandardError)
-
-    def initialize(access_token, redirect_uri, state: nil)
-      @access_token = access_token
-      @redirect_uri = redirect_uri
-      @state = state
-    end
-
-    def authorize_url
-      client.auth_code.authorize_url(
-        redirect_uri: redirect_uri,
-        scope: scope,
-        state: state # This is used for arbitary redirection
-      )
-    end
-
-    def get_token(code)
-      client.auth_code.get_token(code, redirect_uri: redirect_uri).token
-    end
-
-    protected
-
-    def scope
-      raise NotImplementedError
-    end
-
-    private
-
-    def config
-      Gitlab.config.omniauth.providers.find { |provider| provider.name == "google_oauth2" }
-    end
-
-    def client
-      return @client if defined?(@client)
-
-      unless config
-        raise ConfigMissingError
-      end
-
-      @client = ::OAuth2::Client.new(
-        config.app_id,
-        config.app_secret,
-        site: 'https://accounts.google.com',
-        token_url: '/o/oauth2/token', 
-        authorize_url: '/o/oauth2/auth'
-      )
-    end
-  end
-end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 0bc306a24e6..74ae5e16ab2 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -2,9 +2,9 @@ require 'google/apis/container_v1'
 
 module GoogleApi
   module CloudPlatform
-    class Client < GoogleApi::Authentication
+    class Client < GoogleApi::Auth
       class << self
-        def token_in_session
+        def session_key_for_token
           :cloud_platform_access_token
         end
       end
@@ -13,20 +13,14 @@ module GoogleApi
         'https://www.googleapis.com/auth/cloud-platform'
       end
 
-      ##
-      # Exception
-      # Google::Apis::ClientError:
-      # Google::Apis::AuthorizationError:
-      ##
-
       def projects_zones_clusters_get(project_id, zone, cluster_id)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
         begin
           cluster = service.get_zone_cluster(project_id, zone, cluster_id)
-        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return nil
+        rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+          return e
         end
 
         puts "#{self.class.name} - #{__callee__}: cluster: #{cluster.inspect}"
@@ -35,7 +29,7 @@ module GoogleApi
 
       # Responce exmaple 
       # TODO: machine_type : Defailt 3.75 GB
-      def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size:, machine_type:)
+      def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size, machine_type:)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
@@ -50,8 +44,8 @@ module GoogleApi
 
         begin
           operation = service.create_cluster(project_id, zone, request_body)
-        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return nil
+        rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+          return e
         end
 
         puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
@@ -65,17 +59,15 @@ module GoogleApi
         begin
           operation = service.get_zone_operation(project_id, zone, operation_id)
         rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return nil
+          return e
         end
 
         puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
         operation
       end
 
-      def parse_self_link(self_link)
-        ret = self_link.match(/projects\/(.*)\/zones\/(.*)\/operations\/(.*)/)
-
-        return ret[1], ret[2], ret[3] # project_id, zone, operation_id
+      def parse_operation_id(self_link)
+        self_link.match(/projects\/.*\/zones\/.*\/operations\/(.*)/)[1]
       end
     end
   end
-- 
cgit v1.2.1


From 2d1a77b8a3567cae61f73196918fe365d4fe9415 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Sun, 1 Oct 2017 17:48:21 +0900
Subject: Revert KubernetesService. Introduce FetchKubernetesTokenService.

---
 app/models/ci/cluster.rb                          |  8 ++-
 app/models/project_services/kubernetes_service.rb | 18 +-----
 app/services/ci/create_cluster_service.rb         |  4 ++
 app/services/ci/fetch_kubernetes_token_service.rb | 70 +++++++++++++++++++++++
 app/services/ci/integrate_cluster_service.rb      | 27 ++++-----
 app/services/ci/update_cluster_service.rb         | 14 ++---
 app/views/projects/clusters/_form.html.haml       |  2 +-
 app/workers/wait_for_cluster_creation_worker.rb   | 59 ++++++++-----------
 lib/google_api/cloud_platform/client.rb           |  9 ++-
 9 files changed, 127 insertions(+), 84 deletions(-)
 create mode 100644 app/services/ci/fetch_kubernetes_token_service.rb

diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index d1b69c19965..594739075e4 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -33,13 +33,15 @@ module Ci
     }
 
     def error!(reason)
-      update!(status: statuses[:errored],
-              status_reason: reason,
-              gcp_token: nil)
+      update!(status: statuses[:errored], status_reason: reason, gcp_token: nil)
     end
 
     def on_creation?
       scheduled? || creating?
     end
+
+    def api_url
+      'https://' + endpoint
+    end
   end
 end
diff --git a/app/models/project_services/kubernetes_service.rb b/app/models/project_services/kubernetes_service.rb
index 0f5f9aae93c..8ba07173c74 100644
--- a/app/models/project_services/kubernetes_service.rb
+++ b/app/models/project_services/kubernetes_service.rb
@@ -15,7 +15,6 @@ class KubernetesService < DeploymentService
   # Bearer authentication
   # TODO:  user/password auth, client certificates
   prop_accessor :token
-  attr_accessor :username, :password
 
   # Provide a custom CA bundle for self-signed deployments
   prop_accessor :ca_pem
@@ -139,15 +138,6 @@ class KubernetesService < DeploymentService
 
   TEMPLATE_PLACEHOLDER = 'Kubernetes namespace'.freeze
 
-  def read_secrets
-    kubeclient = build_kubeclient!
-
-    kubeclient.get_secrets.as_json
-  rescue KubeException => err
-    raise err unless err.error_code == 404
-    []
-  end
-
   private
 
   def kubeconfig
@@ -167,7 +157,7 @@ class KubernetesService < DeploymentService
   end
 
   def build_kubeclient!(api_path: 'api', api_version: 'v1')
-    raise "Incomplete settings" unless api_url && (token || (username && password))
+    raise "Incomplete settings" unless api_url && actual_namespace && token
 
     ::Kubeclient::Client.new(
       join_api_url(api_path),
@@ -200,11 +190,7 @@ class KubernetesService < DeploymentService
   end
 
   def kubeclient_auth_options
-    if token
-      { bearer_token: token }
-    else
-      { username: username, password: password }
-    end
+    { bearer_token: token }
   end
 
   def join_api_url(api_path)
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index 86820706831..b5fb71f5092 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -1,6 +1,10 @@
 module Ci
   class CreateClusterService < BaseService
     def execute(access_token)
+      if params['machine_type'].blank?
+        params['machine_type'] = GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
+      end
+
       project.clusters.create(
         params.merge(user: current_user,
                      status: Ci::Cluster.statuses[:scheduled],
diff --git a/app/services/ci/fetch_kubernetes_token_service.rb b/app/services/ci/fetch_kubernetes_token_service.rb
new file mode 100644
index 00000000000..013e4f12682
--- /dev/null
+++ b/app/services/ci/fetch_kubernetes_token_service.rb
@@ -0,0 +1,70 @@
+##
+# TODO:
+# Almost components in this class were copied from app/models/project_services/kubernetes_service.rb
+# We should dry up those classes not to repeat the same code.
+# Maybe we should have a special facility (e.g. lib/kubernetes_api) to maintain all Kubernetes API caller.
+module Ci
+  class FetchKubernetesTokenService
+    attr_reader :api_url, :ca_pem, :username, :password
+
+    def initialize(api_url, ca_pem, username, password)
+      @api_url = api_url
+      @ca_pem = ca_pem
+      @username = username
+      @password = password
+    end
+
+    def execute
+      read_secrets.each do |secret|
+        name = secret.dig('metadata', 'name')
+        if /default-token/ =~ name
+          token_base64 = secret.dig('data', 'token')
+          return Base64.decode64(token_base64) if token_base64
+        end
+      end
+    end
+
+    private
+
+    def read_secrets
+      kubeclient = build_kubeclient!
+
+      kubeclient.get_secrets.as_json
+    rescue KubeException => err
+      raise err unless err.error_code == 404
+      []
+    end
+
+    def build_kubeclient!(api_path: 'api', api_version: 'v1')
+      raise "Incomplete settings" unless api_url && username && password
+
+      ::Kubeclient::Client.new(
+        join_api_url(api_path),
+        api_version,
+        auth_options: { username: username, password: password },
+        ssl_options: kubeclient_ssl_options,
+        http_proxy_uri: ENV['http_proxy']
+      )
+    end
+
+    def join_api_url(api_path)
+      url = URI.parse(api_url)
+      prefix = url.path.sub(%r{/+\z}, '')
+
+      url.path = [prefix, api_path].join("/")
+
+      url.to_s
+    end
+
+    def kubeclient_ssl_options
+      opts = { verify_ssl: OpenSSL::SSL::VERIFY_PEER }
+
+      if ca_pem.present?
+        opts[:cert_store] = OpenSSL::X509::Store.new
+        opts[:cert_store].add_cert(OpenSSL::X509::Certificate.new(ca_pem))
+      end
+
+      opts
+    end
+  end
+end
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index d5b1ccd345d..5dd1f2b3414 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -1,21 +1,10 @@
 module Ci
   class IntegrateClusterService
     def execute(cluster, endpoint, ca_cert, token, username, password)
-      kubernetes_service ||= cluster.project.find_or_initialize_service('kubernetes')
-
       Ci::Cluster.transaction do
-        # Update service
-        kubernetes_service.attributes = {
-          active: true,
-          api_url: endpoint,
-          ca_pem: ca_cert,
-          namespace: cluster.project_namespace,
-          token: token
-        }
-
-        kubernetes_service.save!
+        kubernetes_service ||=
+          cluster.project.find_or_initialize_service('kubernetes')
 
-        # Save info in cluster record
         cluster.update!(
           enabled: true,
           service: kubernetes_service,
@@ -25,10 +14,16 @@ module Ci
           ca_cert: ca_cert,
           endpoint: endpoint,
           gcp_token: nil,
-          status: Ci::Cluster.statuses[:created]
-        )
-      end
+          gcp_operation_id: nil,
+          status: Ci::Cluster.statuses[:created])
 
+        kubernetes_service.update!(
+          active: true,
+          api_url: cluster.api_url,
+          ca_pem: ca_cert,
+          namespace: cluster.project_namespace,
+          token: token)
+      end
     rescue ActiveRecord::RecordInvalid => e
       cluster.error!("Failed to integrate cluster into kubernetes_service: #{e.message}")
     end
diff --git a/app/services/ci/update_cluster_service.rb b/app/services/ci/update_cluster_service.rb
index 0b458e27b90..a440ac03a0b 100644
--- a/app/services/ci/update_cluster_service.rb
+++ b/app/services/ci/update_cluster_service.rb
@@ -2,22 +2,18 @@ module Ci
   class UpdateClusterService < BaseService
     def execute(cluster)
       Ci::Cluster.transaction do
-        if params['enabled'] == 'true'
+        cluster.update!(enabled: params['enabled'])
 
-          cluster.service.attributes = {
+        if params['enabled'] == 'true'
+          cluster.service.update!(
             active: true,
-            api_url: cluster.endpoint,
+            api_url: cluster.api_url,
             ca_pem: cluster.ca_cert,
             namespace: cluster.project_namespace,
-            token: cluster.kubernetes_token
-          }
-
-          cluster.service.save!
+            token: cluster.kubernetes_token)
         else
           cluster.service.update(active: false)
         end
-
-        cluster.update!(enabled: params['enabled'])
       end
     rescue ActiveRecord::RecordInvalid => e
       cluster.errors.add(:base, e.message)
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 10a4b4d8ba8..4912abfb58f 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -33,4 +33,4 @@
           = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
 
           -# TODO: Remove before merge
-          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: '???'}), method: :post
\ No newline at end of file
+          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: 'n1-standard-1'}), method: :post
\ No newline at end of file
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index e0dce5a60cd..8d84f28c0cf 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -17,69 +17,56 @@ class WaitForClusterCreationWorker
       GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
 
     operation = api_client.projects_zones_operations(
-        cluster.gcp_project_id,
-        cluster.cluster_zone,
-        cluster.gcp_operation_id
-      )
+      cluster.gcp_project_id,
+      cluster.cluster_zone,
+      cluster.gcp_operation_id)
 
     if operation.is_a?(StandardError)
       return cluster.error!("Failed to request to CloudPlatform; #{operation.message}")
     end
 
     case operation.status
-    when 'DONE'
-      integrate(api_client, cluster)
     when 'RUNNING'
       if Time.now < operation.start_time.to_time + TIMEOUT
         WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
       else
         return cluster.error!("Cluster creation time exceeds timeout; #{TIMEOUT}")
       end
+    when 'DONE'
+      integrate(cluster, api_client)
     else
-      return cluster.error!("Unexpected operation status; #{operation.status_message}")
+      return cluster.error!("Unexpected operation status; #{operation.status} #{operation.status_message}")
     end
   end
 
-  def integrate(api_client, cluster)
-    # Get cluster details (end point, etc)
+  def integrate(cluster, api_client)
     gke_cluster = api_client.projects_zones_clusters_get(
-        cluster.gcp_project_id,
-        cluster.cluster_zone,
-        cluster.cluster_name
-      )
+      cluster.gcp_project_id,
+      cluster.cluster_zone,
+      cluster.cluster_name)
 
     if gke_cluster.is_a?(StandardError)
       return cluster.error!("Failed to request to CloudPlatform; #{gke_cluster.message}")
     end
 
-    # Get k8s token
-    kubernetes_token = ''
-    KubernetesService.new.tap do |ks|
-      ks.api_url = 'https://' + gke_cluster.endpoint
-      ks.ca_pem = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-      ks.username = gke_cluster.master_auth.username
-      ks.password = gke_cluster.master_auth.password
-      secrets = ks.read_secrets
-      secrets.each do |secret|
-        name = secret.dig('metadata', 'name')
-        if /default-token/ =~ name
-          token_base64 = secret.dig('data', 'token')
-          kubernetes_token = Base64.decode64(token_base64)
-          break
-        end
-      end
+    begin
+      endpoint = gke_cluster.endpoint
+      api_url = 'https://' + endpoint
+      ca_cert = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+      username = gke_cluster.master_auth.username
+      password = gke_cluster.master_auth.password
+    rescue Exception => e
+      return cluster.error!("Can not extract the extected data; #{e}")
     end
 
+    kubernetes_token = Ci::FetchKubernetesTokenService.new(
+      api_url, ca_cert, username, password).execute
+
     unless kubernetes_token
       return cluster.error!('Failed to get a default token of kubernetes')
     end
 
-    # k8s endpoint, ca_cert
-    endpoint = 'https://' + gke_cluster.endpoint
-    ca_cert = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-    username = gke_cluster.master_auth.username
-    password = gke_cluster.master_auth.password
-
-    Ci::IntegrateClusterService.new.execute(cluster, endpoint, ca_cert, kubernetes_token, username, password)
+    Ci::IntegrateClusterService.new.execute(
+      cluster, endpoint, ca_cert, kubernetes_token, username, password)
   end
 end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 74ae5e16ab2..a1abc5bf074 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -3,6 +3,8 @@ require 'google/apis/container_v1'
 module GoogleApi
   module CloudPlatform
     class Client < GoogleApi::Auth
+      DEFAULT_MACHINE_TYPE = 'n1-standard-1'
+
       class << self
         def session_key_for_token
           :cloud_platform_access_token
@@ -27,8 +29,6 @@ module GoogleApi
         cluster
       end
 
-      # Responce exmaple 
-      # TODO: machine_type : Defailt 3.75 GB
       def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size, machine_type:)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
@@ -37,7 +37,10 @@ module GoogleApi
             {
               "cluster": {
                 "name": cluster_name,
-                "initial_node_count": cluster_size
+                "initial_node_count": cluster_size,
+                "node_config": {
+                  "machine_type": machine_type # Default 3.75 GB, if ommit
+                }
               }
             }
           )
-- 
cgit v1.2.1


From 5663b4808df787b1bcbf32ba54eccbb4c7537e25 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Sun, 1 Oct 2017 20:30:32 +0900
Subject: authorize in controller. validation in model.

---
 app/controllers/projects/clusters_controller.rb | 15 ++---------
 app/models/ci/cluster.rb                        | 35 +++++++++++++++++++++++--
 app/policies/project_policy.rb                  |  1 +
 app/views/projects/clusters/_form.html.haml     |  1 +
 app/views/projects/clusters/edit.html.haml      | 19 +++++++++-----
 app/workers/cluster_creation_worker.rb          | 11 ++++----
 app/workers/wait_for_cluster_creation_worker.rb | 12 ++++-----
 db/migrate/20170924094327_create_ci_clusters.rb |  8 +++---
 db/schema.rb                                    |  8 +++---
 9 files changed, 69 insertions(+), 41 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 840c623e778..ebb17bca010 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -1,8 +1,7 @@
 class Projects::ClustersController < Projects::ApplicationController
   before_action :cluster, except: [:login, :index, :new, :create]
+  before_action :authorize_admin_cluster!
   before_action :authorize_google_api, except: [:login]
-  # before_action :cluster_creation_lock, only: [:update, :destroy]
-  # before_action :authorize_admin_clusters! # TODO: Authentication
 
   def login
     begin
@@ -67,9 +66,7 @@ class Projects::ClustersController < Projects::ApplicationController
     if cluster.destroy
       redirect_to project_clusters_path(project), status: 302
     else
-      redirect_to project_clusters_path(project),
-                  status: :forbidden,
-                  alert: _("Failed to remove the cluster")
+      render :edit
     end
   end
 
@@ -94,12 +91,4 @@ class Projects::ClustersController < Projects::ApplicationController
   def token_in_session
     @token_in_session ||= session[GoogleApi::CloudPlatform::Client.session_key_for_token]
   end
-
-  def cluster_creation_lock
-    if cluster.on_creation?
-      redirect_to edit_project_cluster_path(project, cluster),
-                  status: :forbidden,
-                  alert: _("You can not modify cluster during creation")
-    end
-  end
 end
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
index 594739075e4..93f582f565a 100644
--- a/app/models/ci/cluster.rb
+++ b/app/models/ci/cluster.rb
@@ -32,8 +32,26 @@ module Ci
       errored: 4
     }
 
-    def error!(reason)
-      update!(status: statuses[:errored], status_reason: reason, gcp_token: nil)
+    validates :gcp_project_id, presence: true
+    validates :cluster_zone, presence: true
+    validates :cluster_name, presence: true
+    validates :cluster_size, presence: true,
+              numericality: { only_integer: true, greater_than: 0 }
+    validate :restrict_modification, on: :update
+
+    def errored!(reason)
+      self.status = :errored
+      self.status_reason = reason
+      self.gcp_token = nil
+
+      save!(validate: false)
+    end
+
+    def creating!(gcp_operation_id)
+      self.status = :creating
+      self.gcp_operation_id = gcp_operation_id
+
+      save!(validate: false)
     end
 
     def on_creation?
@@ -43,5 +61,18 @@ module Ci
     def api_url
       'https://' + endpoint
     end
+
+    def restrict_modification
+      if on_creation?
+        errors.add(:base, "cannot modify during creation")
+        return false
+      end
+
+      true
+    end
+
+    def destroy
+      super if restrict_modification
+    end
   end
 end
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index b7b5bd34189..279b19eb576 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -188,6 +188,7 @@ class ProjectPolicy < BasePolicy
     enable :admin_build
     enable :admin_container_image
     enable :admin_pipeline
+    enable :admin_cluster
     enable :admin_environment
     enable :admin_deployment
     enable :admin_pages
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 4912abfb58f..d2a2bc0b6be 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -5,6 +5,7 @@
       = s_('ClusterIntegration|Use our %{link_to_help_page} on cluster integration.').html_safe % { link_to_help_page: link_to_help_page}
 
       = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
+        = form_errors(@cluster)
         .form-group
           = field.label :cluster_name
           = field.text_field :cluster_name, class: 'form-control'
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 7f8400d9ea1..fa5d14b514a 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,16 +1,23 @@
 edit/show cluster
 %br
 = @cluster.inspect
+%br
 = @cluster.service.inspect
-- unless @cluster.on_creation?
-  = link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'true'}), method: :put
-  = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
-  = link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
+%br
+= form_errors(@cluster)
+%br
+= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'true'}), method: :put
+%br
+= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
+%br
+= link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
+%br
 -# status GET
 -# status: The current status of the operation.
 -# status_reason: If an error has occurred, a textual description of the error.
 = link_to 'Check status', status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), :remote => true
+%br
 -# simply rendering error, if it happened
-- if @cluster.status_reason
-  %p= status_reason
+status_reason
+%p= @cluster.status_reason
 -# Even if we got an error during the creation process, we don't delete cluster objects automatically, because we don't have a method to delete the cluster on gke. So users move to edit page from new page **regardless of validation errors**, and they have to delete the record manually. This is for giving users headsup that a new cluster might remain in gke. /cc @ayufan
diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
index 0b547089b94..40e40005022 100644
--- a/app/workers/cluster_creation_worker.rb
+++ b/app/workers/cluster_creation_worker.rb
@@ -21,27 +21,26 @@ class ClusterCreationWorker
       )
 
     if operation.is_a?(StandardError)
-      return cluster.error!("Failed to request to CloudPlatform; #{operation.message}")
+      return cluster.errored!("Failed to request to CloudPlatform; #{operation.message}")
     end
       
     unless operation.status == 'RUNNING' || operation.status == 'PENDING'
-      return cluster.error!("Operation status is unexpected; #{operation.status_message}")
+      return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
     end
 
     operation_id = api_client.parse_operation_id(operation.self_link)
 
     unless operation_id
-      return cluster.error!('Can not find operation_id from self_link')
+      return cluster.errored!('Can not find operation_id from self_link')
     end
 
-    if cluster.update(status: Ci::Cluster.statuses[:creating],
-                      gcp_operation_id: operation_id)
+    if cluster.creating!(operation_id)
       WaitForClusterCreationWorker.perform_in(
         WaitForClusterCreationWorker::INITIAL_INTERVAL,
         cluster.id
       )
     else
-      return cluster.error!("Failed to update cluster record; #{cluster.errors}")
+      return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
     end
   end
 end
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index 8d84f28c0cf..5ffe70d4ba6 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -22,7 +22,7 @@ class WaitForClusterCreationWorker
       cluster.gcp_operation_id)
 
     if operation.is_a?(StandardError)
-      return cluster.error!("Failed to request to CloudPlatform; #{operation.message}")
+      return cluster.errored!("Failed to request to CloudPlatform; #{operation.message}")
     end
 
     case operation.status
@@ -30,12 +30,12 @@ class WaitForClusterCreationWorker
       if Time.now < operation.start_time.to_time + TIMEOUT
         WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
       else
-        return cluster.error!("Cluster creation time exceeds timeout; #{TIMEOUT}")
+        return cluster.errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
       end
     when 'DONE'
       integrate(cluster, api_client)
     else
-      return cluster.error!("Unexpected operation status; #{operation.status} #{operation.status_message}")
+      return cluster.errored!("Unexpected operation status; #{operation.status} #{operation.status_message}")
     end
   end
 
@@ -46,7 +46,7 @@ class WaitForClusterCreationWorker
       cluster.cluster_name)
 
     if gke_cluster.is_a?(StandardError)
-      return cluster.error!("Failed to request to CloudPlatform; #{gke_cluster.message}")
+      return cluster.errored!("Failed to request to CloudPlatform; #{gke_cluster.message}")
     end
 
     begin
@@ -56,14 +56,14 @@ class WaitForClusterCreationWorker
       username = gke_cluster.master_auth.username
       password = gke_cluster.master_auth.password
     rescue Exception => e
-      return cluster.error!("Can not extract the extected data; #{e}")
+      return cluster.errored!("Can not extract the extected data; #{e}")
     end
 
     kubernetes_token = Ci::FetchKubernetesTokenService.new(
       api_url, ca_cert, username, password).execute
 
     unless kubernetes_token
-      return cluster.error!('Failed to get a default token of kubernetes')
+      return cluster.errored!('Failed to get a default token of kubernetes')
     end
 
     Ci::IntegrateClusterService.new.execute(
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
index 798c8e03b37..bef39b9808d 100644
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ b/db/migrate/20170924094327_create_ci_clusters.rb
@@ -27,10 +27,10 @@ class CreateCiClusters < ActiveRecord::Migration
       t.string :encrypted_password_iv
 
       # GKE
-      t.string :gcp_project_id
-      t.string :cluster_zone
-      t.string :cluster_name
-      t.string :cluster_size
+      t.string :gcp_project_id, null: false
+      t.string :cluster_zone, null: false
+      t.string :cluster_name, null: false
+      t.integer :cluster_size, null: false
       t.string :machine_type
       t.string :gcp_operation_id
       t.string :encrypted_gcp_token
diff --git a/db/schema.rb b/db/schema.rb
index de844583d56..61245f3f666 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -284,10 +284,10 @@ ActiveRecord::Schema.define(version: 20170924094327) do
     t.string "encrypted_password"
     t.string "encrypted_password_salt"
     t.string "encrypted_password_iv"
-    t.string "gcp_project_id"
-    t.string "cluster_zone"
-    t.string "cluster_name"
-    t.string "cluster_size"
+    t.string "gcp_project_id", null: false
+    t.string "cluster_zone", null: false
+    t.string "cluster_name", null: false
+    t.integer "cluster_size", null: false
     t.string "machine_type"
     t.string "gcp_operation_id"
     t.string "encrypted_gcp_token"
-- 
cgit v1.2.1


From 00ee7a9f27d3d00936127957eb3c99f803d3e880 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Sun, 1 Oct 2017 16:45:48 +0100
Subject: FE review changes app code

---
 app/assets/javascripts/diff.js                     |  2 +-
 .../notes/components/issue_comment_form.vue        |  4 ++--
 .../components/issue_discussion_locked_widget.vue  |  4 ++--
 .../components/confidential/edit_form_buttons.vue  |  4 ++--
 .../sidebar/components/lock/lock_issue_sidebar.vue | 22 +++++++++++++++++-----
 app/assets/javascripts/sidebar/sidebar_bundle.js   | 22 +++++++++++-----------
 .../vue_shared/components/issue/issue_warning.vue  |  2 ++
 .../javascripts/vue_shared/mixins/issuable.js      |  4 +++-
 db/schema.rb                                       |  1 +
 9 files changed, 41 insertions(+), 24 deletions(-)

diff --git a/app/assets/javascripts/diff.js b/app/assets/javascripts/diff.js
index 8959365a5c9..c49f83e7089 100644
--- a/app/assets/javascripts/diff.js
+++ b/app/assets/javascripts/diff.js
@@ -18,7 +18,7 @@ class Diff {
     });
 
     const tab = document.getElementById('diffs');
-    if (!tab || (tab && !Object.hasOwnProperty.call(tab.dataset, 'isLocked'))) FilesCommentButton.init($diffFile);
+    if (!tab || (tab && tab.dataset && tab.dataset.isLocked !== '')) FilesCommentButton.init($diffFile);
 
     $diffFile.each((index, file) => new gl.ImageFile(file));
 
diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index 3682c95f6eb..715027c6fbc 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -58,7 +58,7 @@
       isIssueOpen() {
         return this.issueState === constants.OPENED || this.issueState === constants.REOPENED;
       },
-      canCreate() {
+      canCreateNote() {
         return this.getIssueData.current_user.can_create_note;
       },
       issueActionButtonTitle() {
@@ -241,7 +241,7 @@
 <template>
   <div>
     <issue-note-signed-out-widget v-if="!isLoggedIn" />
-    <issue-discussion-locked-widget v-else-if="!canCreate" />
+    <issue-discussion-locked-widget v-else-if="!canCreateNote" />
     <ul
       v-else
       class="notes notes-form timeline">
diff --git a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
index f0429b82aaa..e73ec2aaf71 100644
--- a/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
+++ b/app/assets/javascripts/notes/components/issue_discussion_locked_widget.vue
@@ -1,7 +1,7 @@
 <script>
   export default {
     computed: {
-      icon() {
+      lockIcon() {
         return gl.utils.spriteIcon('lock');
       },
     },
@@ -12,7 +12,7 @@
 <template>
   <div class="disabled-comment text-center">
     <span class="issuable-note-warning">
-      <span class="icon" v-html="icon"></span>
+      <span class="icon" v-html="lockIcon"></span>
       <span>This issue is locked. Only <b>project members</b> can comment.</span>
      </span>
   </div>
diff --git a/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue b/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
index 143f8ae7bc1..7ed0619ee6b 100644
--- a/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
+++ b/app/assets/javascripts/sidebar/components/confidential/edit_form_buttons.vue
@@ -15,7 +15,7 @@ export default {
     },
   },
   computed: {
-    buttonText() {
+    toggleButtonText() {
       return this.isConfidential ? 'Turn Off' : 'Turn On';
     },
     updateConfidentialBool() {
@@ -39,7 +39,7 @@ export default {
       class="btn btn-close"
       @click.prevent="updateConfidentialAttribute(updateConfidentialBool)"
     >
-      {{ buttonText }}
+      {{ toggleButtonText }}
     </button>
   </div>
 </template>
diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
index 9021d17dddf..cc214039bdd 100644
--- a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -86,7 +86,7 @@ export default {
     </div>
 
     <div class="value sidebar-item-value hide-collapsed">
-      <editForm
+      <edit-form
         v-if="isLockDialogOpen"
         :toggle-form="toggleForm"
         :is-locked="isLocked"
@@ -94,13 +94,25 @@ export default {
         :issuable-type="issuableType"
       />
 
-      <div v-if="isLocked" class="value sidebar-item-value">
-        <i aria-hidden="true" class="fa fa-lock sidebar-item-icon is-active"></i>
+      <div
+        v-if="isLocked"
+        class="value sidebar-item-value"
+      >
+        <i
+          aria-hidden="true"
+          class="fa fa-lock sidebar-item-icon is-active"
+        ></i>
         {{ __('Locked') }}
       </div>
 
-      <div v-else class="no-value sidebar-item-value hide-collapsed">
-        <i aria-hidden="true" class="fa fa-unlock sidebar-item-icon"></i>
+      <div
+        v-else
+        class="no-value sidebar-item-value hide-collapsed"
+      >
+        <i
+          aria-hidden="true"
+          class="fa fa-unlock sidebar-item-icon"
+        ></i>
         {{ __('Unlocked') }}
       </div>
     </div>
diff --git a/app/assets/javascripts/sidebar/sidebar_bundle.js b/app/assets/javascripts/sidebar/sidebar_bundle.js
index 645e65d7b16..09b9d75c02d 100644
--- a/app/assets/javascripts/sidebar/sidebar_bundle.js
+++ b/app/assets/javascripts/sidebar/sidebar_bundle.js
@@ -1,9 +1,9 @@
 import Vue from 'vue';
-import sidebarTimeTracking from './components/time_tracking/sidebar_time_tracking';
-import sidebarAssignees from './components/assignees/sidebar_assignees';
-import confidential from './components/confidential/confidential_issue_sidebar.vue';
+import SidebarTimeTracking from './components/time_tracking/sidebar_time_tracking';
+import SidebarAssignees from './components/assignees/sidebar_assignees';
+import ConfidentialIssueSidebar from './components/confidential/confidential_issue_sidebar.vue';
 import SidebarMoveIssue from './lib/sidebar_move_issue';
-import lockBlock from './components/lock/lock_issue_sidebar.vue';
+import LockIssueSidebar from './components/lock/lock_issue_sidebar.vue';
 import Translate from '../vue_shared/translate';
 
 import Mediator from './sidebar_mediator';
@@ -11,14 +11,14 @@ import Mediator from './sidebar_mediator';
 Vue.use(Translate);
 
 function mountConfidentialComponent(mediator) {
-  const el = document.querySelector('#js-confidential-entry-point');
+  const el = document.getElementById('js-confidential-entry-point');
 
   if (!el) return;
 
   const dataNode = document.getElementById('js-confidential-issue-data');
   const initialData = JSON.parse(dataNode.innerHTML);
 
-  const ConfidentialComp = Vue.extend(confidential);
+  const ConfidentialComp = Vue.extend(ConfidentialIssueSidebar);
 
   new ConfidentialComp({
     propsData: {
@@ -30,14 +30,14 @@ function mountConfidentialComponent(mediator) {
 }
 
 function mountLockComponent(mediator) {
-  const el = document.querySelector('#js-lock-entry-point');
+  const el = document.getElementById('js-lock-entry-point');
 
   if (!el) return;
 
   const dataNode = document.getElementById('js-lock-issue-data');
   const initialData = JSON.parse(dataNode.innerHTML);
 
-  const LockComp = Vue.extend(lockBlock);
+  const LockComp = Vue.extend(LockIssueSidebar);
 
   new LockComp({
     propsData: {
@@ -54,11 +54,11 @@ function domContentLoaded() {
   const mediator = new Mediator(sidebarOptions);
   mediator.fetch();
 
-  const sidebarAssigneesEl = document.querySelector('#js-vue-sidebar-assignees');
+  const sidebarAssigneesEl = document.getElementById('js-vue-sidebar-assignees');
   // Only create the sidebarAssignees vue app if it is found in the DOM
   // We currently do not use sidebarAssignees for the MR page
   if (sidebarAssigneesEl) {
-    new Vue(sidebarAssignees).$mount(sidebarAssigneesEl);
+    new Vue(SidebarAssignees).$mount(sidebarAssigneesEl);
   }
 
   mountConfidentialComponent(mediator);
@@ -70,7 +70,7 @@ function domContentLoaded() {
     $('.js-move-issue-confirmation-button'),
   ).init();
 
-  new Vue(sidebarTimeTracking).$mount('#issuable-time-tracker');
+  new Vue(SidebarTimeTracking).$mount('#issuable-time-tracker');
 }
 
 document.addEventListener('DOMContentLoaded', domContentLoaded);
diff --git a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
index 0f11b6e2223..7a8be8c42da 100644
--- a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
+++ b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
@@ -4,11 +4,13 @@
       isLocked: {
         type: Boolean,
         default: false,
+        required: false,
       },
 
       isConfidential: {
         type: Boolean,
         default: false,
+        required: false,
       },
     },
 
diff --git a/app/assets/javascripts/vue_shared/mixins/issuable.js b/app/assets/javascripts/vue_shared/mixins/issuable.js
index 831102c0cac..263361587e0 100644
--- a/app/assets/javascripts/vue_shared/mixins/issuable.js
+++ b/app/assets/javascripts/vue_shared/mixins/issuable.js
@@ -1,7 +1,9 @@
 export default {
   methods: {
     issuableDisplayName(issuableType) {
-      return issuableType.replace(/_/, ' ');
+      const displayName = issuableType.replace(/_/, ' ');
+
+      return this.__ ? this.__(displayName) : displayName;
     },
   },
 };
diff --git a/db/schema.rb b/db/schema.rb
index c93fe7bea73..a706eb2a04e 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1218,6 +1218,7 @@ ActiveRecord::Schema.define(version: 20170921115009) do
     t.datetime "last_repository_updated_at"
     t.integer "storage_version", limit: 2
     t.boolean "resolve_outdated_diff_discussions"
+    t.boolean "merge_requests_ff_only_enabled", default: false, null: false
   end
 
   add_index "projects", ["ci_id"], name: "index_projects_on_ci_id", using: :btree
-- 
cgit v1.2.1


From 2cb1d617d90b4a9311e3a35434bec958f266d22a Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 2 Oct 2017 17:13:46 +0900
Subject: Use expires_in for access_token validation

---
 app/controllers/google_api/authorizations_controller.rb | 10 +++++++---
 app/controllers/projects/clusters_controller.rb         | 16 +++++++++++-----
 lib/google_api/auth.rb                                  |  3 ++-
 lib/google_api/cloud_platform/client.rb                 | 16 ++++++++++++++++
 4 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 00b0c128711..890b4ce60c8 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -1,9 +1,13 @@
 module GoogleApi
   class AuthorizationsController < ApplicationController
     def callback
-      session[GoogleApi::CloudPlatform::Client.session_key_for_token] =
-        GoogleApi::CloudPlatform::Client.new(nil, callback_google_api_authorizations_url)
-                                        .get_token(params[:code])
+      token, expires_at = GoogleApi::CloudPlatform::Client
+        .new(nil, callback_google_api_authorizations_url)
+        .get_token(params[:code])
+
+      session[GoogleApi::CloudPlatform::Client.session_key_for_token] = token
+      session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] =
+        expires_at.to_s
 
       if params[:state]
         redirect_to params[:state]
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index ebb17bca010..552cc48d84a 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -6,12 +6,11 @@ class Projects::ClustersController < Projects::ApplicationController
   def login
     begin
       @authorize_url = GoogleApi::CloudPlatform::Client.new(
-          nil,
-          callback_google_api_authorizations_url,
+          nil, callback_google_api_authorizations_url,
           state: namespace_project_clusters_url.to_s
         ).authorize_url
     rescue GoogleApi::Auth::ConfigMissingError
-      # Show an alert message that gitlab.yml is not configured properly
+      # no-op
     end
   end
 
@@ -83,12 +82,19 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def authorize_google_api
-    unless token_in_session
+    unless GoogleApi::CloudPlatform::Client.new(token_in_session, nil)
+                                           .validate_token(expires_at_in_session)
       redirect_to action: 'login'
     end
   end
 
   def token_in_session
-    @token_in_session ||= session[GoogleApi::CloudPlatform::Client.session_key_for_token]
+    @token_in_session ||=
+      session[GoogleApi::CloudPlatform::Client.session_key_for_token]
+  end
+
+  def expires_at_in_session
+    @expires_at_in_session ||=
+      session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at]
   end
 end
diff --git a/lib/google_api/auth.rb b/lib/google_api/auth.rb
index 92787b87ac6..8c962af51d7 100644
--- a/lib/google_api/auth.rb
+++ b/lib/google_api/auth.rb
@@ -19,7 +19,8 @@ module GoogleApi
     end
 
     def get_token(code)
-      client.auth_code.get_token(code, redirect_uri: redirect_uri).token
+      ret = client.auth_code.get_token(code, redirect_uri: redirect_uri)
+      return ret.token, ret.expires_at
     end
 
     protected
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index a1abc5bf074..ec77e6bdd72 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -9,12 +9,28 @@ module GoogleApi
         def session_key_for_token
           :cloud_platform_access_token
         end
+
+        def session_key_for_expires_at
+          :cloud_platform_expires_at
+        end
       end
 
       def scope
         'https://www.googleapis.com/auth/cloud-platform'
       end
 
+      def validate_token(expires_at)
+        return false unless access_token
+        return false unless expires_at
+
+        # Making sure that the token will have been still alive during the cluster creation.
+        unless DateTime.strptime(expires_at, '%s').to_time > Time.now + 10.minutes
+          return false
+        end
+
+        true
+      end
+
       def projects_zones_clusters_get(project_id, zone, cluster_id)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
-- 
cgit v1.2.1


From 59a6f15cd22621826116446d5f28753c973ba2d1 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Mon, 2 Oct 2017 10:34:40 +0100
Subject: Further review changes

---
 app/assets/javascripts/notes/components/issue_comment_form.vue | 7 +++----
 app/assets/javascripts/notes/components/issue_note_form.vue    | 6 +++---
 app/assets/javascripts/notes/mixins/issuable_state.js          | 8 ++++----
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/app/assets/javascripts/notes/components/issue_comment_form.vue b/app/assets/javascripts/notes/components/issue_comment_form.vue
index 715027c6fbc..2c05817ac88 100644
--- a/app/assets/javascripts/notes/components/issue_comment_form.vue
+++ b/app/assets/javascripts/notes/components/issue_comment_form.vue
@@ -266,9 +266,9 @@
               <div class="error-alert"></div>
 
               <issue-warning
-                v-if="hasIssueWarning(getIssueData)"
-                :is-locked="isIssueLocked(getIssueData)"
-                :is-confidential="isIssueConfidential(getIssueData)"
+                v-if="hasWarning(getIssueData)"
+                :is-locked="isLocked(getIssueData)"
+                :is-confidential="isConfidential(getIssueData)"
               />
 
               <markdown-field
@@ -276,7 +276,6 @@
                 :markdown-docs-path="markdownDocsPath"
                 :quick-actions-docs-path="quickActionsDocsPath"
                 :add-spacing-classes="false"
-                :is-confidential-issue="isIssueConfidential(getIssueData)"
                 ref="markdownField">
                 <textarea
                   id="note-body"
diff --git a/app/assets/javascripts/notes/components/issue_note_form.vue b/app/assets/javascripts/notes/components/issue_note_form.vue
index f78289e68aa..e2539d6b89d 100644
--- a/app/assets/javascripts/notes/components/issue_note_form.vue
+++ b/app/assets/javascripts/notes/components/issue_note_form.vue
@@ -129,9 +129,9 @@
       class="edit-note common-note-form js-quick-submit gfm-form">
 
       <issue-warning
-        v-if="hasIssueWarning(getIssueData)"
-        :is-locked="isIssueLocked(getIssueData)"
-        :is-confidential="isIssueConfidential(getIssueData)"
+        v-if="hasWarning(getIssueData)"
+        :is-locked="isLocked(getIssueData)"
+        :is-confidential="isConfidential(getIssueData)"
       />
 
       <markdown-field
diff --git a/app/assets/javascripts/notes/mixins/issuable_state.js b/app/assets/javascripts/notes/mixins/issuable_state.js
index a0b3d81d63b..97f3ea0d5de 100644
--- a/app/assets/javascripts/notes/mixins/issuable_state.js
+++ b/app/assets/javascripts/notes/mixins/issuable_state.js
@@ -1,15 +1,15 @@
 export default {
   methods: {
-    isIssueConfidential(issue) {
+    isConfidential(issue) {
       return !!issue.confidential;
     },
 
-    isIssueLocked(issue) {
+    isLocked(issue) {
       return !!issue.discussion_locked;
     },
 
-    hasIssueWarning(issue) {
-      return this.isIssueConfidential(issue) || this.isIssueLocked(issue);
+    hasWarning(issue) {
+      return this.isConfidential(issue) || this.isLocked(issue);
     },
   },
 };
-- 
cgit v1.2.1


From 25d1c786d0463fbdd4d149c106ce9965601b197f Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 2 Oct 2017 10:41:54 +0100
Subject: Adds clusters to the navigation bar Adds new line at the end of files

---
 app/views/layouts/nav/sidebar/_project.html.haml | 8 +++++++-
 app/views/projects/clusters/_form.html.haml      | 2 +-
 app/views/projects/clusters/_header.html.haml    | 2 +-
 app/views/projects/clusters/_sidebar.html.haml   | 2 +-
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/views/layouts/nav/sidebar/_project.html.haml b/app/views/layouts/nav/sidebar/_project.html.haml
index 8765b814405..ed032b145da 100644
--- a/app/views/layouts/nav/sidebar/_project.html.haml
+++ b/app/views/layouts/nav/sidebar/_project.html.haml
@@ -146,7 +146,7 @@
                   = number_with_delimiter(@project.open_merge_requests_count)
 
       - if project_nav_tab? :pipelines
-        = nav_link(controller: [:pipelines, :builds, :jobs, :pipeline_schedules, :environments, :artifacts]) do
+        = nav_link(controller: [:pipelines, :builds, :jobs, :pipeline_schedules, :environments, :artifacts, :clusters]) do
           = link_to project_pipelines_path(@project), class: 'shortcuts-pipelines' do
             .nav-icon-container
               = sprite_icon('pipeline')
@@ -189,6 +189,12 @@
                   %span
                     Charts
 
+            -# - if project_nav_tab? :clusters TODO @shinya @ayufan
+            = nav_link(controller: :clusters) do
+              = link_to project_clusters_path(@project), title: 'Clusters', class: 'shortcuts-clusters' do
+                %span
+                  Clusters
+
       - if project_nav_tab? :wiki
         = nav_link(controller: :wikis) do
           = link_to get_project_wiki_path(@project), class: 'shortcuts-wiki' do
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index d2a2bc0b6be..1951f1ab9eb 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -34,4 +34,4 @@
           = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
 
           -# TODO: Remove before merge
-          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: 'n1-standard-1'}), method: :post
\ No newline at end of file
+          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: 'n1-standard-1'}), method: :post
diff --git a/app/views/projects/clusters/_header.html.haml b/app/views/projects/clusters/_header.html.haml
index 52a123d603e..795299b0625 100644
--- a/app/views/projects/clusters/_header.html.haml
+++ b/app/views/projects/clusters/_header.html.haml
@@ -12,4 +12,4 @@
         = s_('ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters').html_safe % { link_to_requirements: link_to_requirements }
       %li
         - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'))
-        = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
\ No newline at end of file
+        = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
index f2f9e04f80e..d73a6baf14f 100644
--- a/app/views/projects/clusters/_sidebar.html.haml
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -5,4 +5,4 @@
     = s_('ClusterIntegration|With cluster integration you can take advantage of Kubernetes auto deployment.')
   %p
     - link = link_to(s_('ClusterIntegration|auto deployment'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
-    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab').html_safe % { link_to_documentation: link }
\ No newline at end of file
+    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab').html_safe % { link_to_documentation: link }
-- 
cgit v1.2.1


From cddab09bc69d291924164b1b83fdf7cdbf422dfc Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 2 Oct 2017 12:41:46 +0100
Subject: Starts edit form

---
 app/assets/javascripts/clusters.js             | 11 +++++
 app/assets/stylesheets/pages/clusters.scss     |  5 +++
 app/views/projects/clusters/_sidebar.html.haml |  2 +-
 app/views/projects/clusters/edit.html.haml     | 60 ++++++++++++++++++++++----
 4 files changed, 68 insertions(+), 10 deletions(-)
 create mode 100644 app/assets/javascripts/clusters.js
 create mode 100644 app/assets/stylesheets/pages/clusters.scss

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
new file mode 100644
index 00000000000..64bf22f48e2
--- /dev/null
+++ b/app/assets/javascripts/clusters.js
@@ -0,0 +1,11 @@
+document.addEventListener('DOMContentLoaded', () => {
+
+  const toggleButton = document.querySelector('.js-toggle-cluster');
+  // disable in case of no permissions
+  toggleButton.addEventListener(() => {
+
+    // update text
+  });
+
+  // poll the status
+});
diff --git a/app/assets/stylesheets/pages/clusters.scss b/app/assets/stylesheets/pages/clusters.scss
new file mode 100644
index 00000000000..019ef5cb2f4
--- /dev/null
+++ b/app/assets/stylesheets/pages/clusters.scss
@@ -0,0 +1,5 @@
+.edit-cluster-form {
+  .clipboard-addon {
+    background-color: $white-light;
+  }
+}
\ No newline at end of file
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
index d73a6baf14f..4d19fa460c8 100644
--- a/app/views/projects/clusters/_sidebar.html.haml
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -5,4 +5,4 @@
     = s_('ClusterIntegration|With cluster integration you can take advantage of Kubernetes auto deployment.')
   %p
     - link = link_to(s_('ClusterIntegration|auto deployment'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
-    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab').html_safe % { link_to_documentation: link }
+    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab.').html_safe % { link_to_documentation: link }
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index fa5d14b514a..feea40cee0d 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,16 +1,58 @@
-edit/show cluster
-%br
-= @cluster.inspect
-%br
-= @cluster.service.inspect
-%br
-= form_errors(@cluster)
+.row.prepend-top-default.edit-cluster-form
+  = render 'sidebar'
+  .col-lg-8
+    %h4.prepend-top-0
+      = s_('ClusterIntegration|Enable cluster integration')
+    %p
+      -#TODO: if  can?(current_user, :update_cluster, @cluster)
+      -#  if :enabled
+      = s_('ClusterIntegration|Disabling cluster integration will not affect your cluster. It will only temporarily turn off GitLab\'s conection to it.')
+      -# else
+      = s_('ClusterIntegration|Missing test/state in mockups.')
+      -# else !can?(current_user, :update_cluster, @cluster)
+      -# if :enabled
+      = s_('ClusterIntegration|Cluster integration is enabled for this project.')
+      -# else
+      = s_('ClusterIntegration|Cluster integration is disabled for this project.')
+
+      %label.toggle-wrapper
+      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', aria: { label: 'Toggle' }, data: { 'enabled-text': 'Enable', 'disabled-text': 'disabled' } }
+
+
+    -# render errors TODO
+      #= form_errors(@cluster)
+
+    -# if can?(current_user, :update_cluster, @cluster)
+    .form_group
+      %label
+        = s_('ClusterIntegration|Google container engine')
+      %p
+        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), path: '', target: '_blank', rel: 'noopener noreferrer')
+        = s_('ClusterIntegration|This cluster was not set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+
+    .form_group
+      %label
+        = s_('ClusterIntegration|Cluster name')
+      .input-group
+        %input.form-control{ value: @cluster.cluster_name, disabled: true}
+        %span.input-group-addon.clipboard-addon
+          = clipboard_button(text: @cluster.cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
+
+    %br
+    -# - if can?(current_user, :admin_cluster, @cluster)
+    .well.form_group
+      %label.text-danger
+        = s_('ClusterIntegration|Remove cluster integration')
+      %p
+        = s_('ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project.')
+      = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger')
+
+
 %br
 = link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'true'}), method: :put
 %br
 = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
-%br
-= link_to "Soft-delete the cluster", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete
+
 %br
 -# status GET
 -# status: The current status of the operation.
-- 
cgit v1.2.1


From 34e66c427dde2070c2c09a07ce08f991e46de92f Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 2 Oct 2017 21:58:50 +0900
Subject: PollingInterval, rename to gke_clusters, has_one :cluster

---
 app/controllers/projects/clusters_controller.rb  | 10 ++-
 app/models/ci/cluster.rb                         | 78 --------------------
 app/models/gcp/cluster.rb                        | 93 ++++++++++++++++++++++++
 app/models/project.rb                            |  2 +-
 app/services/ci/create_cluster_service.rb        |  4 +-
 app/services/ci/integrate_cluster_service.rb     | 19 +----
 app/services/ci/update_cluster_service.rb        |  4 +-
 app/workers/cluster_creation_worker.rb           |  2 +-
 app/workers/wait_for_cluster_creation_worker.rb  |  4 +-
 db/migrate/20170924094327_create_ci_clusters.rb  | 48 ------------
 db/migrate/20170924094327_create_gcp_clusters.rb | 44 +++++++++++
 db/schema.rb                                     | 37 +++++++++-
 lib/gitlab/gcp/model.rb                          | 13 ++++
 lib/google_api/cloud_platform/client.rb          |  2 +-
 14 files changed, 204 insertions(+), 156 deletions(-)
 delete mode 100644 app/models/ci/cluster.rb
 create mode 100644 app/models/gcp/cluster.rb
 delete mode 100644 db/migrate/20170924094327_create_ci_clusters.rb
 create mode 100644 db/migrate/20170924094327_create_gcp_clusters.rb
 create mode 100644 lib/gitlab/gcp/model.rb

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 552cc48d84a..2c53e034428 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -15,15 +15,15 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def index
-    if project.clusters.any?
-      redirect_to edit_project_cluster_path(project, project.clusters.last.id)
+    if project.cluster
+      redirect_to edit_project_cluster_path(project, project.cluster)
     else
       redirect_to new_project_cluster_path(project)
     end
   end
 
   def new
-    @cluster = project.clusters.new
+    @cluster = project.build_cluster
   end
 
   def create
@@ -42,6 +42,8 @@ class Projects::ClustersController < Projects::ApplicationController
   def status
     respond_to do |format|
       format.json do
+        Gitlab::PollingInterval.set_header(response, interval: 10_000)
+
         render json: {
           status: cluster.status, # The current status of the operation.
           status_reason: cluster.status_reason # If an error has occurred, a textual description of the error.
@@ -72,7 +74,7 @@ class Projects::ClustersController < Projects::ApplicationController
   private
 
   def cluster
-    @cluster ||= project.clusters.find(params[:id])
+    @cluster ||= project.cluster
   end
 
   def cluster_params
diff --git a/app/models/ci/cluster.rb b/app/models/ci/cluster.rb
deleted file mode 100644
index 93f582f565a..00000000000
--- a/app/models/ci/cluster.rb
+++ /dev/null
@@ -1,78 +0,0 @@
-module Ci
-  class Cluster < ActiveRecord::Base
-    extend Gitlab::Ci::Model
-
-    belongs_to :project
-    belongs_to :user
-    belongs_to :service
-
-    attr_encrypted :password,
-      mode: :per_attribute_iv_and_salt,
-      insecure_mode: true,
-      key: Gitlab::Application.secrets.db_key_base,
-      algorithm: 'aes-256-cbc'
-
-    attr_encrypted :kubernetes_token,
-      mode: :per_attribute_iv_and_salt,
-      insecure_mode: true,
-      key: Gitlab::Application.secrets.db_key_base,
-      algorithm: 'aes-256-cbc'
-
-    attr_encrypted :gcp_token,
-      mode: :per_attribute_iv_and_salt,
-      insecure_mode: true,
-      key: Gitlab::Application.secrets.db_key_base,
-      algorithm: 'aes-256-cbc'
-
-    enum status: {
-      unknown: nil,
-      scheduled: 1,
-      creating: 2,
-      created: 3,
-      errored: 4
-    }
-
-    validates :gcp_project_id, presence: true
-    validates :cluster_zone, presence: true
-    validates :cluster_name, presence: true
-    validates :cluster_size, presence: true,
-              numericality: { only_integer: true, greater_than: 0 }
-    validate :restrict_modification, on: :update
-
-    def errored!(reason)
-      self.status = :errored
-      self.status_reason = reason
-      self.gcp_token = nil
-
-      save!(validate: false)
-    end
-
-    def creating!(gcp_operation_id)
-      self.status = :creating
-      self.gcp_operation_id = gcp_operation_id
-
-      save!(validate: false)
-    end
-
-    def on_creation?
-      scheduled? || creating?
-    end
-
-    def api_url
-      'https://' + endpoint
-    end
-
-    def restrict_modification
-      if on_creation?
-        errors.add(:base, "cannot modify during creation")
-        return false
-      end
-
-      true
-    end
-
-    def destroy
-      super if restrict_modification
-    end
-  end
-end
diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
new file mode 100644
index 00000000000..006cb1feb0c
--- /dev/null
+++ b/app/models/gcp/cluster.rb
@@ -0,0 +1,93 @@
+module Gcp
+  class Cluster < ActiveRecord::Base
+    extend Gitlab::Gcp::Model
+
+    belongs_to :project, inverse_of: :cluster
+    belongs_to :user
+    belongs_to :service
+
+    attr_encrypted :password,
+      mode: :per_attribute_iv,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    attr_encrypted :kubernetes_token,
+      mode: :per_attribute_iv,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    attr_encrypted :gcp_token,
+      mode: :per_attribute_iv,
+      insecure_mode: true,
+      key: Gitlab::Application.secrets.db_key_base,
+      algorithm: 'aes-256-cbc'
+
+    enum status: {
+      unknown: nil,
+      scheduled: 1,
+      creating: 2,
+      created: 3,
+      errored: 4
+    }
+
+    validates :gcp_project_id, presence: true
+    validates :cluster_zone, presence: true
+    validates :cluster_name, presence: true
+    validates :cluster_size, presence: true,
+              numericality: { only_integer: true, greater_than: 0 }
+    validate :restrict_modification, on: :update
+
+    def errored!(reason)
+      self.status = :errored
+      self.status_reason = reason
+      self.gcp_token = nil
+
+      save!(validate: false)
+    end
+
+    def creating!(gcp_operation_id)
+      self.status = :creating
+      self.gcp_operation_id = gcp_operation_id
+
+      save!(validate: false)
+    end
+
+    def created!(endpoint, ca_cert, kubernetes_token, username, password)
+      self.status = :created
+      self.enabled = true
+      self.endpoint = endpoint
+      self.ca_cert = ca_cert
+      self.kubernetes_token = kubernetes_token
+      self.username = username
+      self.password = password
+      self.service = project.find_or_initialize_service('kubernetes')
+      self.gcp_token = nil
+      self.gcp_operation_id = nil
+
+      save!
+    end
+
+    def on_creation?
+      scheduled? || creating?
+    end
+
+    def api_url
+      'https://' + endpoint
+    end
+
+    def restrict_modification
+      if on_creation?
+        errors.add(:base, "cannot modify during creation")
+        return false
+      end
+
+      true
+    end
+
+    def destroy
+      super if restrict_modification
+    end
+  end
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index 6b896746864..5d6a8bdbaeb 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -163,6 +163,7 @@ class Project < ActiveRecord::Base
   has_one :import_data, class_name: 'ProjectImportData', inverse_of: :project, autosave: true
   has_one :project_feature, inverse_of: :project
   has_one :statistics, class_name: 'ProjectStatistics'
+  has_one :cluster, class_name: 'Gcp::Cluster', inverse_of: :project
 
   # Container repositories need to remove data from the container registry,
   # which is not managed by the DB. Hence we're still using dependent: :destroy
@@ -171,7 +172,6 @@ class Project < ActiveRecord::Base
 
   has_many :commit_statuses
   has_many :pipelines, class_name: 'Ci::Pipeline'
-  has_many :clusters, class_name: 'Ci::Cluster'
 
   # Ci::Build objects store data on the file system such as artifact files and
   # build traces. Currently there's no efficient way of removing this data in
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index b5fb71f5092..48d7c9aef23 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -5,9 +5,9 @@ module Ci
         params['machine_type'] = GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
       end
 
-      project.clusters.create(
+      project.create_cluster(
         params.merge(user: current_user,
-                     status: Ci::Cluster.statuses[:scheduled],
+                     status: Gcp::Cluster.statuses[:scheduled],
                      gcp_token: access_token))
     end
   end
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index 5dd1f2b3414..c60d3722373 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -1,23 +1,10 @@
 module Ci
   class IntegrateClusterService
     def execute(cluster, endpoint, ca_cert, token, username, password)
-      Ci::Cluster.transaction do
-        kubernetes_service ||=
-          cluster.project.find_or_initialize_service('kubernetes')
+      Gcp::Cluster.transaction do
+        cluster.created!(endpoint, ca_cert, token, username, password)
 
-        cluster.update!(
-          enabled: true,
-          service: kubernetes_service,
-          username: username,
-          password: password,
-          kubernetes_token: token,
-          ca_cert: ca_cert,
-          endpoint: endpoint,
-          gcp_token: nil,
-          gcp_operation_id: nil,
-          status: Ci::Cluster.statuses[:created])
-
-        kubernetes_service.update!(
+        cluster.service.update!(
           active: true,
           api_url: cluster.api_url,
           ca_pem: ca_cert,
diff --git a/app/services/ci/update_cluster_service.rb b/app/services/ci/update_cluster_service.rb
index a440ac03a0b..a517d6be0c7 100644
--- a/app/services/ci/update_cluster_service.rb
+++ b/app/services/ci/update_cluster_service.rb
@@ -1,7 +1,7 @@
 module Ci
   class UpdateClusterService < BaseService
     def execute(cluster)
-      Ci::Cluster.transaction do
+      Gcp::Cluster.transaction do
         cluster.update!(enabled: params['enabled'])
 
         if params['enabled'] == 'true'
@@ -12,7 +12,7 @@ module Ci
             namespace: cluster.project_namespace,
             token: cluster.kubernetes_token)
         else
-          cluster.service.update(active: false)
+          cluster.service.update!(active: false)
         end
       end
     rescue ActiveRecord::RecordInvalid => e
diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
index 40e40005022..697cb73c2ac 100644
--- a/app/workers/cluster_creation_worker.rb
+++ b/app/workers/cluster_creation_worker.rb
@@ -3,7 +3,7 @@ class ClusterCreationWorker
   include DedicatedSidekiqQueue
 
   def perform(cluster_id)
-    cluster = Ci::Cluster.find_by_id(cluster_id)
+    cluster = Gcp::Cluster.find_by_id(cluster_id)
 
     unless cluster
       return Rails.logger.error "Cluster object is not found; #{cluster_id}"
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index 5ffe70d4ba6..0dd60de5150 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -7,7 +7,7 @@ class WaitForClusterCreationWorker
   TIMEOUT = 20.minutes
 
   def perform(cluster_id)
-    cluster = Ci::Cluster.find_by_id(cluster_id)
+    cluster = Gcp::Cluster.find_by_id(cluster_id)
 
     unless cluster
       return Rails.logger.error "Cluster object is not found; #{cluster_id}"
@@ -56,7 +56,7 @@ class WaitForClusterCreationWorker
       username = gke_cluster.master_auth.username
       password = gke_cluster.master_auth.password
     rescue Exception => e
-      return cluster.errored!("Can not extract the extected data; #{e}")
+      return cluster.errored!("Can not extract the expected data; #{e}")
     end
 
     kubernetes_token = Ci::FetchKubernetesTokenService.new(
diff --git a/db/migrate/20170924094327_create_ci_clusters.rb b/db/migrate/20170924094327_create_ci_clusters.rb
deleted file mode 100644
index bef39b9808d..00000000000
--- a/db/migrate/20170924094327_create_ci_clusters.rb
+++ /dev/null
@@ -1,48 +0,0 @@
-class CreateCiClusters < ActiveRecord::Migration
-  DOWNTIME = false
-
-  def up
-    create_table :ci_clusters do |t|
-      t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
-      t.references :user, null: false, foreign_key: true
-      t.references :service, foreign_key: true
-
-      # General
-      t.boolean :enabled, default: true
-      t.integer :status
-      t.string :status_reason
-
-      # k8s integration specific
-      t.string :project_namespace
-
-      # Cluster details
-      t.string :endpoint
-      t.text :ca_cert
-      t.string :encrypted_kubernetes_token
-      t.string :encrypted_kubernetes_token_salt
-      t.string :encrypted_kubernetes_token_iv
-      t.string :username
-      t.string :encrypted_password
-      t.string :encrypted_password_salt
-      t.string :encrypted_password_iv
-
-      # GKE
-      t.string :gcp_project_id, null: false
-      t.string :cluster_zone, null: false
-      t.string :cluster_name, null: false
-      t.integer :cluster_size, null: false
-      t.string :machine_type
-      t.string :gcp_operation_id
-      t.string :encrypted_gcp_token
-      t.string :encrypted_gcp_token_salt
-      t.string :encrypted_gcp_token_iv
-
-      t.datetime_with_timezone :created_at, null: false
-      t.datetime_with_timezone :updated_at, null: false
-    end
-  end
-
-  def down
-    drop_table :ci_clusters
-  end
-end
diff --git a/db/migrate/20170924094327_create_gcp_clusters.rb b/db/migrate/20170924094327_create_gcp_clusters.rb
new file mode 100644
index 00000000000..9aa8e537dbe
--- /dev/null
+++ b/db/migrate/20170924094327_create_gcp_clusters.rb
@@ -0,0 +1,44 @@
+class CreateGcpClusters < ActiveRecord::Migration
+  DOWNTIME = false
+
+  def change
+    create_table :gcp_clusters do |t|
+      t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
+      t.references :user, null: false, foreign_key: true
+      t.references :service, foreign_key: true
+
+      # General
+      t.boolean :enabled, default: true
+      t.integer :status
+      t.string :status_reason
+
+      # k8s integration specific
+      t.string :project_namespace
+
+      # Cluster details
+      t.string :endpoint
+      t.text :ca_cert
+      t.string :encrypted_kubernetes_token
+      t.string :encrypted_kubernetes_token_salt
+      t.string :encrypted_kubernetes_token_iv
+      t.string :username
+      t.string :encrypted_password
+      t.string :encrypted_password_salt
+      t.string :encrypted_password_iv
+
+      # GKE
+      t.string :gcp_project_id, null: false
+      t.string :cluster_zone, null: false
+      t.string :cluster_name, null: false
+      t.integer :cluster_size, null: false
+      t.string :machine_type
+      t.string :gcp_operation_id
+      t.string :encrypted_gcp_token
+      t.string :encrypted_gcp_token_salt
+      t.string :encrypted_gcp_token_iv
+
+      t.datetime_with_timezone :created_at, null: false
+      t.datetime_with_timezone :updated_at, null: false
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 61245f3f666..62802cd20ee 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170924094327) do
+ActiveRecord::Schema.define(version: 20170928100231) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -608,6 +608,38 @@ ActiveRecord::Schema.define(version: 20170924094327) do
 
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
+  create_table "gcp_clusters", force: :cascade do |t|
+    t.integer "project_id", null: false
+    t.integer "user_id", null: false
+    t.integer "service_id"
+    t.boolean "enabled", default: true
+    t.integer "status"
+    t.string "status_reason"
+    t.string "project_namespace"
+    t.string "endpoint"
+    t.text "ca_cert"
+    t.string "encrypted_kubernetes_token"
+    t.string "encrypted_kubernetes_token_salt"
+    t.string "encrypted_kubernetes_token_iv"
+    t.string "username"
+    t.string "encrypted_password"
+    t.string "encrypted_password_salt"
+    t.string "encrypted_password_iv"
+    t.string "gcp_project_id", null: false
+    t.string "cluster_zone", null: false
+    t.string "cluster_name", null: false
+    t.integer "cluster_size", null: false
+    t.string "machine_type"
+    t.string "gcp_operation_id"
+    t.string "encrypted_gcp_token"
+    t.string "encrypted_gcp_token_salt"
+    t.string "encrypted_gcp_token_iv"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+  end
+
+  add_index "gcp_clusters", ["project_id"], name: "index_gcp_clusters_on_project_id", unique: true, using: :btree
+
   create_table "gpg_keys", force: :cascade do |t|
     t.datetime_with_timezone "created_at", null: false
     t.datetime_with_timezone "updated_at", null: false
@@ -1742,6 +1774,9 @@ ActiveRecord::Schema.define(version: 20170924094327) do
   add_foreign_key "events", "projects", on_delete: :cascade
   add_foreign_key "events", "users", column: "author_id", name: "fk_edfd187b6f", on_delete: :cascade
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
+  add_foreign_key "gcp_clusters", "projects", on_delete: :cascade
+  add_foreign_key "gcp_clusters", "services"
+  add_foreign_key "gcp_clusters", "users"
   add_foreign_key "gpg_keys", "users", on_delete: :cascade
   add_foreign_key "gpg_signatures", "gpg_keys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "projects", on_delete: :cascade
diff --git a/lib/gitlab/gcp/model.rb b/lib/gitlab/gcp/model.rb
new file mode 100644
index 00000000000..195391f0e3c
--- /dev/null
+++ b/lib/gitlab/gcp/model.rb
@@ -0,0 +1,13 @@
+module Gitlab
+  module Gcp
+    module Model
+      def table_name_prefix
+        "gcp_"
+      end
+
+      def model_name
+        @model_name ||= ActiveModel::Name.new(self, nil, self.name.split("::").last)
+      end
+    end
+  end
+end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index ec77e6bdd72..aa85fcdabef 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -86,7 +86,7 @@ module GoogleApi
       end
 
       def parse_operation_id(self_link)
-        self_link.match(/projects\/.*\/zones\/.*\/operations\/(.*)/)[1]
+        self_link.match(%r{projects/.*/zones/.*/operations/(.*)})[1]
       end
     end
   end
-- 
cgit v1.2.1


From fd44ac2b14baeafb1a9ea5c761671213dc4cf613 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 2 Oct 2017 16:53:26 +0100
Subject: Updates sidebar

---
 app/assets/javascripts/clusters.js             | 11 -----------
 app/views/projects/clusters/_form.html.haml    |  3 +++
 app/views/projects/clusters/_header.html.haml  |  6 +++---
 app/views/projects/clusters/_sidebar.html.haml |  6 +++---
 app/views/projects/clusters/edit.html.haml     | 10 ++++++----
 app/views/projects/clusters/login.html.haml    |  5 +++--
 6 files changed, 18 insertions(+), 23 deletions(-)

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index 64bf22f48e2..e69de29bb2d 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -1,11 +0,0 @@
-document.addEventListener('DOMContentLoaded', () => {
-
-  const toggleButton = document.querySelector('.js-toggle-cluster');
-  // disable in case of no permissions
-  toggleButton.addEventListener(() => {
-
-    // update text
-  });
-
-  // poll the status
-});
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index 1951f1ab9eb..ebe4d9380eb 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -12,10 +12,12 @@
 
         .form-group
           = field.label :gcp_project_id
+          = link_to(s_('ClusterIntegration|See your projects'), 'https://console.cloud.google.com/home/dashboard', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :gcp_project_id, class: 'form-control'
 
         .form-group
           = field.label :cluster_zone
+          = link_to(s_('ClusterIntegration|See zones'), 'https://cloud.google.com/compute/docs/regions-zones/regions-zones', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :cluster_zone, class: 'form-control'
 
         .form-group
@@ -28,6 +30,7 @@
 
         .form-group
           = field.label :machine_type
+          = link_to(s_('ClusterIntegration|Machine type'), 'https://cloud.google.com/compute/docs/machine-types', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :machine_type, class: 'form-control'
 
         .form-group
diff --git a/app/views/projects/clusters/_header.html.haml b/app/views/projects/clusters/_header.html.haml
index 795299b0625..c7c5272089a 100644
--- a/app/views/projects/clusters/_header.html.haml
+++ b/app/views/projects/clusters/_header.html.haml
@@ -5,11 +5,11 @@
     = s_('ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:')
   %ul
     %li
-      - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'))
+      - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'), 'https://console.cloud.google.com', target: '_blank', rel: 'noopener noreferrer')
       = s_('ClusterIntegration|Your account must have %{link_to_container_engine}').html_safe % { link_to_container_engine: link_to_container_engine }
       %li
-        - link_to_requirements = link_to(s_('ClusterIntegration|meets the requirements'))
+        - link_to_requirements = link_to(s_('ClusterIntegration|meets the requirements'), 'https://cloud.google.com/container-engine/docs/quickstart', target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters').html_safe % { link_to_requirements: link_to_requirements }
       %li
-        - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'))
+        - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'), target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
index 4d19fa460c8..739c38e073a 100644
--- a/app/views/projects/clusters/_sidebar.html.haml
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -2,7 +2,7 @@
   %h4.prepend-top-0
     = s_('ClusterIntegration|Cluster integration')
   %p
-    = s_('ClusterIntegration|With cluster integration you can take advantage of Kubernetes auto deployment.')
+    = s_('ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way.')
   %p
-    - link = link_to(s_('ClusterIntegration|auto deployment'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
-    = s_('ClusterIntegration|Learn more about %{link_to_documentation} in GitLab.').html_safe % { link_to_documentation: link }
+    - link = link_to(s_('ClusterIntegration|cluster'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
+    = s_('ClusterIntegration|Learn more about %{link_to_documentation}').html_safe % { link_to_documentation: link }
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index feea40cee0d..16d864423f5 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,4 +1,4 @@
-.row.prepend-top-default.edit-cluster-form
+.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id)}}
   = render 'sidebar'
   .col-lg-8
     %h4.prepend-top-0
@@ -15,9 +15,11 @@
       -# else
       = s_('ClusterIntegration|Cluster integration is disabled for this project.')
 
-      %label.toggle-wrapper
+    %label.toggle-wrapper
       %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', aria: { label: 'Toggle' }, data: { 'enabled-text': 'Enable', 'disabled-text': 'disabled' } }
 
+    .form-group
+
 
     -# render errors TODO
       #= form_errors(@cluster)
@@ -27,7 +29,7 @@
       %label
         = s_('ClusterIntegration|Google container engine')
       %p
-        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), path: '', target: '_blank', rel: 'noopener noreferrer')
+        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), '', target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|This cluster was not set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
 
     .form_group
@@ -49,7 +51,7 @@
 
 
 %br
-= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'true'}), method: :put
+= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :put
 %br
 = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
 
diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
index ef6efc84ceb..3c68d4dbabc 100644
--- a/app/views/projects/clusters/login.html.haml
+++ b/app/views/projects/clusters/login.html.haml
@@ -6,5 +6,6 @@
     - if @authorize_url
       %a{ href: @authorize_url }
         = image_tag('auth_buttons/signin_with_google.png')
-    -# - else
-    -#   You have not configrued GitLab properly. So we can not proceed authentication. Please check if you have set up omniauth->providers->google_oauth2 in gitlab.yml
+    - else
+      - link = link_to(s_('ClusterIntegration|properly configured'), help_page_path("integration/google"), target: '_blank', rel: 'noopener noreferrer')
+      = s_('Google authentication is not %{link_to_documentation}. Ask your GitLab administrator if you want to use this service.').html_safe % { link_to_documentation: link }
-- 
cgit v1.2.1


From fd6776214abb2603ce2fb5dfb078229f0a0195e5 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 2 Oct 2017 20:49:04 +0100
Subject: Adds toggle button Adds polling function

---
 app/assets/javascripts/clusters.js         | 136 +++++++++++++++++++++++++++++
 app/assets/javascripts/dispatcher.js       |   5 ++
 app/views/projects/clusters/edit.html.haml |  45 ++++++----
 3 files changed, 168 insertions(+), 18 deletions(-)

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index e69de29bb2d..63ff676486b 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -0,0 +1,136 @@
+/* globals Flash */
+import Visibility from 'visibilityjs';
+import axios from 'axios';
+import Poll from './lib/utils/poll';
+import { s__ } from './locale';
+import './flash';
+
+class ClusterService {
+  constructor(options = {}) {
+    this.options = options;
+  }
+
+  fetchData() {
+    return axios.get(this.options.endpoints.checkStatus);
+  }
+
+  updateData(value) {
+    return axios.put(this.options.endpoints.editPath,
+      {
+        cluster: {
+          enabled: value,
+        },
+      },
+    );
+  }
+}
+/**
+ * Handles visibily toggle
+ * Polls the state
+ */
+export default class ClusterEdit {
+  constructor() {
+    const dataset = document.querySelector('.js-edit-cluster-form').dataset;
+
+    this.state = {
+      endpoints: {
+        checkStatus: dataset.checkStatus,
+        editPath: dataset.editPath,
+      },
+      canUpdate: dataset.canUpdate,
+      clusterStatus: dataset.clusterStatus,
+    };
+
+    this.service = new ClusterService({ endpoints: this.state.endpoints });
+    this.toggleButton = document.querySelector('.js-toggle-cluster');
+    this.errorContainer = document.querySelector('.js-cluster-error');
+    this.successContainer = document.querySelector('.js-cluster-success');
+    this.creatingContainer = document.querySelector('.js-cluster-creating');
+    this.bindEvents();
+  }
+
+  bindEvents() {
+    if (!this.canUpdate) {
+      this.disableToggle();
+    }
+
+    if (this.clusterStatus) {
+      // update to enable or disabled!
+    }
+
+    this.toggleButton.addEventListener('click', this.toggle.bind(this));
+
+    document.querySelector('.js-edit-cluster-button').addEventListener('click', this.updateData.bind(this));
+
+    this.initPoling();
+  }
+
+  toggle() {
+    this.toggleButton.classList.toggle('checked');
+    this.toggleStatus = this.toggleButton.classList.contains('checked').toString();
+  }
+
+  updateData() {
+    this.service.updateData(this.state.toggleStatus);
+  }
+
+  disableToggle(disable = true) {
+    this.toggleButton.classList.toggle('disabled', disable);
+    this.toggleButton.setAttribute('disabled', disable);
+  }
+
+  initPoling() {
+    if (this.state.clusterStatus === 'created') return;
+
+    this.poll = new Poll({
+      resource: this.service,
+      method: 'fetchData',
+      successCallback: (data) => {
+        const { status } = data.data;
+        this.updateContainer(status);
+      },
+      errorCallback: () => {
+        this.updateContainer('error');
+        Flash(s__('ClusterIntegration|Something went wrong on our end.'));
+      },
+    });
+
+    if (!Visibility.hidden()) {
+      this.poll.makeRequest();
+    } else {
+      this.service.fetchData();
+    }
+
+    Visibility.change(() => {
+      if (!Visibility.hidden()) {
+        this.poll.restart();
+      } else {
+        this.poll.stop();
+      }
+    });
+  }
+
+  hideAll() {
+    this.errorContainer.classList.add('hidden');
+    this.successContainer.classList.add('hidden');
+    this.creatingContainer.classList.add('hidden');
+  }
+
+  updateContainer(status) {
+    this.hideAll();
+    switch (status) {
+      case 'created':
+        this.successContainer.classList.remove('hidden');
+        break;
+      case 'error':
+        this.errorContainer.classList.remove('hidden');
+        break;
+      case 'creating':
+        this.creatingContainer.classList.add('hidden');
+        break;
+      default:
+        this.hideAll();
+    }
+  }
+
+}
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index 31214818496..7131889a0a0 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -524,6 +524,11 @@ import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
         case 'admin:impersonation_tokens:index':
           new gl.DueDateSelectors();
           break;
+        case 'projects:clusters:edit':
+          import(/* webpackChunkName: "clusters" */ './clusters')
+            .then(cluster => new cluster.default()) // eslint-disable-line new-cap
+            .catch(() => {});
+          break;
       }
       switch (path[0]) {
         case 'sessions':
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
index 16d864423f5..0f6be36e56a 100644
--- a/app/views/projects/clusters/edit.html.haml
+++ b/app/views/projects/clusters/edit.html.haml
@@ -1,4 +1,7 @@
-.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id)}}
+.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json),
+  edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id, format: :json),
+  can_update: 'true',
+  cluster_status: '' }}
   = render 'sidebar'
   .col-lg-8
     %h4.prepend-top-0
@@ -16,21 +19,37 @@
       = s_('ClusterIntegration|Cluster integration is disabled for this project.')
 
     %label.toggle-wrapper
-      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', aria: { label: 'Toggle' }, data: { 'enabled-text': 'Enable', 'disabled-text': 'disabled' } }
+      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', 'aria-label': 'Toggle', data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
 
+    -# if can?(current_user, :update_cluster, @cluster)
     .form-group
+      %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
+        = s_('ClusterIntegration|Save changes')
 
 
-    -# render errors TODO
-      #= form_errors(@cluster)
-
     -# if can?(current_user, :update_cluster, @cluster)
     .form_group
       %label
         = s_('ClusterIntegration|Google container engine')
-      %p
+
         - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), '', target: '_blank', rel: 'noopener noreferrer')
-        = s_('ClusterIntegration|This cluster was not set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+      .hidden.js-cluster-error
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+
+      .hidden.js-cluster-success
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+
+      .hidden.js-cluster-creating
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+        = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
     .form_group
       %label
@@ -50,18 +69,8 @@
       = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger')
 
 
+
 %br
 = link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :put
 %br
 = link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
-
-%br
--# status GET
--# status: The current status of the operation.
--# status_reason: If an error has occurred, a textual description of the error.
-= link_to 'Check status', status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id), :remote => true
-%br
--# simply rendering error, if it happened
-status_reason
-%p= @cluster.status_reason
--# Even if we got an error during the creation process, we don't delete cluster objects automatically, because we don't have a method to delete the cluster on gke. So users move to edit page from new page **regardless of validation errors**, and they have to delete the record manually. This is for giving users headsup that a new cluster might remain in gke. /cc @ayufan
-- 
cgit v1.2.1


From b0df3c747e38abe8ad1ae00ef57a9d767d16d2b7 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Tue, 3 Oct 2017 11:20:05 +0200
Subject: Remove redundant column from the schema

---
 db/schema.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/db/schema.rb b/db/schema.rb
index 8443f86b21c..c5cac79dbfd 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1218,7 +1218,6 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.datetime "last_repository_updated_at"
     t.integer "storage_version", limit: 2
     t.boolean "resolve_outdated_diff_discussions"
-    t.boolean "merge_requests_ff_only_enabled", default: false, null: false
     t.boolean "repository_read_only"
   end
 
-- 
cgit v1.2.1


From fc95cd5bc6666076b5aceec20046e771f5c126bf Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Tue, 3 Oct 2017 15:03:59 +0200
Subject: fix db schema

---
 db/schema.rb | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/db/schema.rb b/db/schema.rb
index c5cac79dbfd..5ffcbd30c16 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -32,8 +32,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.text "description", null: false
     t.string "header_logo"
     t.string "logo"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.text "description_html"
     t.integer "cached_markdown_version"
   end
@@ -274,8 +274,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.string "encrypted_value_iv"
     t.integer "group_id", null: false
     t.boolean "protected", default: false, null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
   end
 
   add_index "ci_group_variables", ["group_id", "key"], name: "index_ci_group_variables_on_group_id_and_key", unique: true, using: :btree
@@ -287,8 +287,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.string "encrypted_value_salt"
     t.string "encrypted_value_iv"
     t.integer "pipeline_schedule_id", null: false
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime_with_timezone "created_at"
+    t.datetime_with_timezone "updated_at"
   end
 
   add_index "ci_pipeline_schedule_variables", ["pipeline_schedule_id", "key"], name: "index_ci_pipeline_schedule_variables_on_schedule_id_and_key", unique: true, using: :btree
@@ -537,8 +537,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.integer "project_id"
     t.integer "author_id", null: false
     t.integer "target_id"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "action", limit: 2, null: false
     t.string "target_type"
   end
@@ -576,8 +576,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
   create_table "gpg_keys", force: :cascade do |t|
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "user_id"
     t.binary "primary_keyid"
     t.binary "fingerprint"
@@ -589,8 +589,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_index "gpg_keys", ["user_id"], name: "index_gpg_keys_on_user_id", using: :btree
 
   create_table "gpg_signatures", force: :cascade do |t|
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.integer "project_id"
     t.integer "gpg_key_id"
     t.binary "commit_sha"
@@ -789,8 +789,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_index "members", ["user_id"], name: "index_members_on_user_id", using: :btree
 
   create_table "merge_request_diff_commits", id: false, force: :cascade do |t|
-    t.datetime "authored_date"
-    t.datetime "committed_date"
+    t.datetime_with_timezone "authored_date"
+    t.datetime_with_timezone "committed_date"
     t.integer "merge_request_diff_id", null: false
     t.integer "relative_order", null: false
     t.binary "sha", null: false
@@ -1115,8 +1115,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
 
   create_table "project_auto_devops", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
     t.boolean "enabled"
     t.string "domain"
   end
-- 
cgit v1.2.1


From 6b7889f750c56962c0674467c3fbfd7976b9b44f Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 3 Oct 2017 23:44:06 +0900
Subject: Implement Policy. Use show instead of edit. Chnage db column. fix
 comments. dry up workers

---
 app/controllers/projects/clusters_controller.rb    | 28 +++++---
 app/models/gcp/cluster.rb                          |  9 +--
 app/policies/gcp/cluster_policy.rb                 | 16 +++++
 app/policies/project_policy.rb                     |  3 +-
 app/services/ci/create_cluster_service.rb          |  8 +--
 app/services/ci/create_gke_cluster_service.rb      | 37 +++++++++++
 app/services/ci/fetch_gcp_operation_service.rb     | 17 +++++
 .../ci/finalize_cluster_creation_service.rb        | 33 ++++++++++
 app/views/projects/clusters/_form.html.haml        | 18 ++---
 app/views/projects/clusters/edit.html.haml         | 76 ----------------------
 app/views/projects/clusters/show.html.haml         | 76 ++++++++++++++++++++++
 app/workers/cluster_creation_worker.rb             | 40 +-----------
 app/workers/wait_for_cluster_creation_worker.rb    | 73 ++++-----------------
 config/routes/project.rb                           |  2 +-
 db/migrate/20170924094327_create_gcp_clusters.rb   | 11 ++--
 db/schema.rb                                       | 46 ++-----------
 lib/google_api/cloud_platform/client.rb            | 32 ++-------
 17 files changed, 247 insertions(+), 278 deletions(-)
 create mode 100644 app/policies/gcp/cluster_policy.rb
 create mode 100644 app/services/ci/create_gke_cluster_service.rb
 create mode 100644 app/services/ci/fetch_gcp_operation_service.rb
 create mode 100644 app/services/ci/finalize_cluster_creation_service.rb
 delete mode 100644 app/views/projects/clusters/edit.html.haml
 create mode 100644 app/views/projects/clusters/show.html.haml

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 2c53e034428..1b6165def51 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -1,7 +1,10 @@
 class Projects::ClustersController < Projects::ApplicationController
   before_action :cluster, except: [:login, :index, :new, :create]
-  before_action :authorize_admin_cluster!
-  before_action :authorize_google_api, except: [:login]
+  before_action :authorize_read_cluster!
+  before_action :authorize_create_cluster!, only: [:new, :create]
+  before_action :authorize_google_api, only: [:new, :create]
+  before_action :authorize_update_cluster!, only: [:update]
+  before_action :authorize_admin_cluster!, only: [:destroy]
 
   def login
     begin
@@ -16,7 +19,7 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def index
     if project.cluster
-      redirect_to edit_project_cluster_path(project, project.cluster)
+      redirect_to project_cluster_path(project, project.cluster)
     else
       redirect_to new_project_cluster_path(project)
     end
@@ -32,7 +35,6 @@ class Projects::ClustersController < Projects::ApplicationController
       .execute(token_in_session)
 
     if @cluster.persisted?
-      ClusterCreationWorker.perform_async(@cluster.id)
       redirect_to project_clusters_path(project)
     else
       render :new
@@ -52,7 +54,7 @@ class Projects::ClustersController < Projects::ApplicationController
     end
   end
 
-  def edit
+  def show
   end
 
   def update
@@ -60,14 +62,14 @@ class Projects::ClustersController < Projects::ApplicationController
       .new(project, current_user, cluster_params)
       .execute(cluster)
 
-    render :edit
+    render :show
   end
 
   def destroy
     if cluster.destroy
       redirect_to project_clusters_path(project), status: 302
     else
-      render :edit
+      render :show
     end
   end
 
@@ -79,8 +81,8 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def cluster_params
     params.require(:cluster)
-      .permit(:gcp_project_id, :cluster_zone, :cluster_name, :cluster_size,
-              :machine_type, :project_namespace, :enabled)
+      .permit(:gcp_project_id, :gcp_cluster_zone, :gcp_cluster_name, :gcp_cluster_size,
+              :gcp_machine_type, :project_namespace, :enabled)
   end
 
   def authorize_google_api
@@ -99,4 +101,12 @@ class Projects::ClustersController < Projects::ApplicationController
     @expires_at_in_session ||=
       session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at]
   end
+
+  def authorize_update_cluster!
+    return access_denied! unless can?(current_user, :update_cluster, cluster)
+  end
+
+  def authorize_admin_cluster!
+    return access_denied! unless can?(current_user, :admin_cluster, cluster)
+  end
 end
diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 006cb1feb0c..8b39bedad55 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -8,19 +8,16 @@ module Gcp
 
     attr_encrypted :password,
       mode: :per_attribute_iv,
-      insecure_mode: true,
       key: Gitlab::Application.secrets.db_key_base,
       algorithm: 'aes-256-cbc'
 
     attr_encrypted :kubernetes_token,
       mode: :per_attribute_iv,
-      insecure_mode: true,
       key: Gitlab::Application.secrets.db_key_base,
       algorithm: 'aes-256-cbc'
 
     attr_encrypted :gcp_token,
       mode: :per_attribute_iv,
-      insecure_mode: true,
       key: Gitlab::Application.secrets.db_key_base,
       algorithm: 'aes-256-cbc'
 
@@ -33,9 +30,9 @@ module Gcp
     }
 
     validates :gcp_project_id, presence: true
-    validates :cluster_zone, presence: true
-    validates :cluster_name, presence: true
-    validates :cluster_size, presence: true,
+    validates :gcp_cluster_zone, presence: true
+    validates :gcp_cluster_name, presence: true
+    validates :gcp_cluster_size, presence: true,
               numericality: { only_integer: true, greater_than: 0 }
     validate :restrict_modification, on: :update
 
diff --git a/app/policies/gcp/cluster_policy.rb b/app/policies/gcp/cluster_policy.rb
new file mode 100644
index 00000000000..dd0a5bff146
--- /dev/null
+++ b/app/policies/gcp/cluster_policy.rb
@@ -0,0 +1,16 @@
+module Gcp
+  class ClusterPolicy < BasePolicy
+    alias_method :cluster, :subject
+
+    delegate { @subject.project }
+
+    condition(:safe_to_change) do
+      can?(:master_access) && !cluster.on_creation?
+    end
+
+    rule { safe_to_change }.policy do
+      enable :update_cluster
+      enable :admin_cluster
+    end
+  end
+end
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index 279b19eb576..b9894284226 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -164,6 +164,7 @@ class ProjectPolicy < BasePolicy
     enable :create_pipeline
     enable :update_pipeline
     enable :create_pipeline_schedule
+    enable :read_cluster
     enable :create_merge_request
     enable :create_wiki
     enable :push_code
@@ -188,7 +189,7 @@ class ProjectPolicy < BasePolicy
     enable :admin_build
     enable :admin_container_image
     enable :admin_pipeline
-    enable :admin_cluster
+    enable :create_cluster
     enable :admin_environment
     enable :admin_deployment
     enable :admin_pages
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index 48d7c9aef23..2fb6df9d669 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -1,14 +1,14 @@
 module Ci
   class CreateClusterService < BaseService
     def execute(access_token)
-      if params['machine_type'].blank?
-        params['machine_type'] = GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
-      end
+      params['gcp_machine_type'] ||= GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
 
       project.create_cluster(
         params.merge(user: current_user,
                      status: Gcp::Cluster.statuses[:scheduled],
-                     gcp_token: access_token))
+                     gcp_token: access_token)).tap do |cluster|
+        ClusterCreationWorker.perform_async(cluster.id) if cluster.persisted?
+      end
     end
   end
 end
diff --git a/app/services/ci/create_gke_cluster_service.rb b/app/services/ci/create_gke_cluster_service.rb
new file mode 100644
index 00000000000..2407de5fc75
--- /dev/null
+++ b/app/services/ci/create_gke_cluster_service.rb
@@ -0,0 +1,37 @@
+module Ci
+  class CreateGkeClusterService
+    def execute(cluster)
+      api_client =
+        GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+      begin
+        operation = api_client.projects_zones_clusters_create(
+            cluster.gcp_project_id,
+            cluster.gcp_cluster_zone,
+            cluster.gcp_cluster_name,
+            cluster.gcp_cluster_size,
+            machine_type: cluster.gcp_machine_type
+          )
+      rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+      end
+        
+      unless operation.status == 'RUNNING' || operation.status == 'PENDING'
+        return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
+      end
+
+      operation_id = api_client.parse_operation_id(operation.self_link)
+
+      unless operation_id
+        return cluster.errored!('Can not find operation_id from self_link')
+      end
+
+      if cluster.creating!(operation_id)
+        WaitForClusterCreationWorker.perform_in(
+          WaitForClusterCreationWorker::INITIAL_INTERVAL, cluster.id)
+      else
+        return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
+      end
+    end
+  end
+end
diff --git a/app/services/ci/fetch_gcp_operation_service.rb b/app/services/ci/fetch_gcp_operation_service.rb
new file mode 100644
index 00000000000..24892d1ab47
--- /dev/null
+++ b/app/services/ci/fetch_gcp_operation_service.rb
@@ -0,0 +1,17 @@
+module Ci
+  class FetchGcpOperationService
+    def execute(cluster)
+      api_client = 
+        GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+      operation = api_client.projects_zones_operations(
+        cluster.gcp_project_id,
+        cluster.gcp_cluster_zone,
+        cluster.gcp_operation_id)
+
+      yield(operation) if block_given?
+    rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+      return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+    end
+  end
+end
diff --git a/app/services/ci/finalize_cluster_creation_service.rb b/app/services/ci/finalize_cluster_creation_service.rb
new file mode 100644
index 00000000000..03cd761deb7
--- /dev/null
+++ b/app/services/ci/finalize_cluster_creation_service.rb
@@ -0,0 +1,33 @@
+module Ci
+  class FinalizeClusterCreationService
+    def execute(cluster)
+      api_client = 
+        GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+      begin
+        gke_cluster = api_client.projects_zones_clusters_get(
+          cluster.gcp_project_id,
+          cluster.gcp_cluster_zone,
+          cluster.gcp_cluster_name)
+      rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+      end
+
+      endpoint = gke_cluster.endpoint
+      api_url = 'https://' + endpoint
+      ca_cert = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
+      username = gke_cluster.master_auth.username
+      password = gke_cluster.master_auth.password
+
+      kubernetes_token = Ci::FetchKubernetesTokenService.new(
+        api_url, ca_cert, username, password).execute
+
+      unless kubernetes_token
+        return cluster.errored!('Failed to get a default token of kubernetes')
+      end
+
+      Ci::IntegrateClusterService.new.execute(
+        cluster, endpoint, ca_cert, kubernetes_token, username, password)
+    end
+  end
+end
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index ebe4d9380eb..a59c48b2c68 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -7,8 +7,8 @@
       = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
         = form_errors(@cluster)
         .form-group
-          = field.label :cluster_name
-          = field.text_field :cluster_name, class: 'form-control'
+          = field.label :gcp_cluster_name
+          = field.text_field :gcp_cluster_name, class: 'form-control'
 
         .form-group
           = field.label :gcp_project_id
@@ -16,25 +16,25 @@
           = field.text_field :gcp_project_id, class: 'form-control'
 
         .form-group
-          = field.label :cluster_zone
+          = field.label :gcp_cluster_zone
           = link_to(s_('ClusterIntegration|See zones'), 'https://cloud.google.com/compute/docs/regions-zones/regions-zones', target: '_blank', rel: 'noopener noreferrer')
-          = field.text_field :cluster_zone, class: 'form-control'
+          = field.text_field :gcp_cluster_zone, class: 'form-control'
 
         .form-group
-          = field.label :cluster_size
-          = field.text_field :cluster_size, class: 'form-control'
+          = field.label :gcp_cluster_size
+          = field.text_field :gcp_cluster_size, class: 'form-control'
 
         .form-group
           = field.label :project_namespace
           = field.text_field :project_namespace, class: 'form-control'
 
         .form-group
-          = field.label :machine_type
+          = field.label :gcp_machine_type
           = link_to(s_('ClusterIntegration|Machine type'), 'https://cloud.google.com/compute/docs/machine-types', target: '_blank', rel: 'noopener noreferrer')
-          = field.text_field :machine_type, class: 'form-control'
+          = field.text_field :gcp_machine_type, class: 'form-control'
 
         .form-group
           = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
 
           -# TODO: Remove before merge
-          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', cluster_zone: 'us-central1-a', cluster_size: '1', project_namespace: 'aaa', machine_type: 'n1-standard-1'}), method: :post
+          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {gcp_cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', gcp_cluster_zone: 'us-central1-a', gcp_cluster_size: '1', project_namespace: 'aaa', gcp_machine_type: 'n1-standard-1'}), method: :post
diff --git a/app/views/projects/clusters/edit.html.haml b/app/views/projects/clusters/edit.html.haml
deleted file mode 100644
index 0f6be36e56a..00000000000
--- a/app/views/projects/clusters/edit.html.haml
+++ /dev/null
@@ -1,76 +0,0 @@
-.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json),
-  edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id, format: :json),
-  can_update: 'true',
-  cluster_status: '' }}
-  = render 'sidebar'
-  .col-lg-8
-    %h4.prepend-top-0
-      = s_('ClusterIntegration|Enable cluster integration')
-    %p
-      -#TODO: if  can?(current_user, :update_cluster, @cluster)
-      -#  if :enabled
-      = s_('ClusterIntegration|Disabling cluster integration will not affect your cluster. It will only temporarily turn off GitLab\'s conection to it.')
-      -# else
-      = s_('ClusterIntegration|Missing test/state in mockups.')
-      -# else !can?(current_user, :update_cluster, @cluster)
-      -# if :enabled
-      = s_('ClusterIntegration|Cluster integration is enabled for this project.')
-      -# else
-      = s_('ClusterIntegration|Cluster integration is disabled for this project.')
-
-    %label.toggle-wrapper
-      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', 'aria-label': 'Toggle', data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
-
-    -# if can?(current_user, :update_cluster, @cluster)
-    .form-group
-      %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
-        = s_('ClusterIntegration|Save changes')
-
-
-    -# if can?(current_user, :update_cluster, @cluster)
-    .form_group
-      %label
-        = s_('ClusterIntegration|Google container engine')
-
-        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), '', target: '_blank', rel: 'noopener noreferrer')
-      .hidden.js-cluster-error
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
-
-      .hidden.js-cluster-success
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
-
-      .hidden.js-cluster-creating
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
-        = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
-
-    .form_group
-      %label
-        = s_('ClusterIntegration|Cluster name')
-      .input-group
-        %input.form-control{ value: @cluster.cluster_name, disabled: true}
-        %span.input-group-addon.clipboard-addon
-          = clipboard_button(text: @cluster.cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
-
-    %br
-    -# - if can?(current_user, :admin_cluster, @cluster)
-    .well.form_group
-      %label.text-danger
-        = s_('ClusterIntegration|Remove cluster integration')
-      %p
-        = s_('ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project.')
-      = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger')
-
-
-
-%br
-= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :put
-%br
-= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
new file mode 100644
index 00000000000..7d09c9e8934
--- /dev/null
+++ b/app/views/projects/clusters/show.html.haml
@@ -0,0 +1,76 @@
+.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json),
+  edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id, format: :json),
+  can_update: 'true',
+  cluster_status: '' }}
+  = render 'sidebar'
+  .col-lg-8
+    %h4.prepend-top-0
+      = s_('ClusterIntegration|Enable cluster integration')
+    %p
+      -#TODO: if  can?(current_user, :update_cluster, @cluster)
+      -#  if :enabled
+      = s_('ClusterIntegration|Disabling cluster integration will not affect your cluster. It will only temporarily turn off GitLab\'s conection to it.')
+      -# else
+      = s_('ClusterIntegration|Missing test/state in mockups.')
+      -# else !can?(current_user, :update_cluster, @cluster)
+      -# if :enabled
+      = s_('ClusterIntegration|Cluster integration is enabled for this project.')
+      -# else
+      = s_('ClusterIntegration|Cluster integration is disabled for this project.')
+
+    %label.toggle-wrapper
+      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', 'aria-label': 'Toggle', data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
+
+    -# if can?(current_user, :update_cluster, @cluster)
+    .form-group
+      %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
+        = s_('ClusterIntegration|Save changes')
+
+
+    -# if can?(current_user, :update_cluster, @cluster)
+    .form_group
+      %label
+        = s_('ClusterIntegration|Google container engine')
+
+        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), '', target: '_blank', rel: 'noopener noreferrer')
+      .hidden.js-cluster-error
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+
+      .hidden.js-cluster-success
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+
+      .hidden.js-cluster-creating
+        %p
+          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
+        .alert.alert-info{ role: 'alert' }
+        = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
+
+    .form_group
+      %label
+        = s_('ClusterIntegration|Cluster name')
+      .input-group
+        %input.form-control{ value: @cluster.gcp_cluster_name, disabled: true}
+        %span.input-group-addon.clipboard-addon
+          = clipboard_button(text: @cluster.gcp_cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
+
+    %br
+    -# - if can?(current_user, :admin_cluster, @cluster)
+    .well.form_group
+      %label.text-danger
+        = s_('ClusterIntegration|Remove cluster integration')
+      %p
+        = s_('ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project.')
+      = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger')
+
+
+
+%br
+= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :put
+%br
+= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
index 697cb73c2ac..220519134b9 100644
--- a/app/workers/cluster_creation_worker.rb
+++ b/app/workers/cluster_creation_worker.rb
@@ -3,44 +3,8 @@ class ClusterCreationWorker
   include DedicatedSidekiqQueue
 
   def perform(cluster_id)
-    cluster = Gcp::Cluster.find_by_id(cluster_id)
-
-    unless cluster
-      return Rails.logger.error "Cluster object is not found; #{cluster_id}"
-    end
-
-    api_client =
-      GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
-
-    operation = api_client.projects_zones_clusters_create(
-        cluster.gcp_project_id,
-        cluster.cluster_zone,
-        cluster.cluster_name,
-        cluster.cluster_size,
-        machine_type: cluster.machine_type
-      )
-
-    if operation.is_a?(StandardError)
-      return cluster.errored!("Failed to request to CloudPlatform; #{operation.message}")
-    end
-      
-    unless operation.status == 'RUNNING' || operation.status == 'PENDING'
-      return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
-    end
-
-    operation_id = api_client.parse_operation_id(operation.self_link)
-
-    unless operation_id
-      return cluster.errored!('Can not find operation_id from self_link')
-    end
-
-    if cluster.creating!(operation_id)
-      WaitForClusterCreationWorker.perform_in(
-        WaitForClusterCreationWorker::INITIAL_INTERVAL,
-        cluster.id
-      )
-    else
-      return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
+    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
+      Ci::CreateGkeClusterService.new.execute(cluster)
     end
   end
 end
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index 0dd60de5150..d1f9b4e07f4 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -7,66 +7,21 @@ class WaitForClusterCreationWorker
   TIMEOUT = 20.minutes
 
   def perform(cluster_id)
-    cluster = Gcp::Cluster.find_by_id(cluster_id)
-
-    unless cluster
-      return Rails.logger.error "Cluster object is not found; #{cluster_id}"
-    end
-
-    api_client = 
-      GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
-
-    operation = api_client.projects_zones_operations(
-      cluster.gcp_project_id,
-      cluster.cluster_zone,
-      cluster.gcp_operation_id)
-
-    if operation.is_a?(StandardError)
-      return cluster.errored!("Failed to request to CloudPlatform; #{operation.message}")
-    end
-
-    case operation.status
-    when 'RUNNING'
-      if Time.now < operation.start_time.to_time + TIMEOUT
-        WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
-      else
-        return cluster.errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
+    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
+      Ci::FetchGcpOperationService.new.execute(cluster) do |operation|
+        case operation.status
+        when 'RUNNING'
+          if TIMEOUT < Time.now - operation.start_time.to_time
+            return cluster.errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
+          end
+
+          WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
+        when 'DONE'
+          Ci::FinalizeClusterCreationService.new.execute(cluster)
+        else
+          return cluster.errored!("Unexpected operation status; #{operation.status} #{operation.status_message}")
+        end
       end
-    when 'DONE'
-      integrate(cluster, api_client)
-    else
-      return cluster.errored!("Unexpected operation status; #{operation.status} #{operation.status_message}")
     end
   end
-
-  def integrate(cluster, api_client)
-    gke_cluster = api_client.projects_zones_clusters_get(
-      cluster.gcp_project_id,
-      cluster.cluster_zone,
-      cluster.cluster_name)
-
-    if gke_cluster.is_a?(StandardError)
-      return cluster.errored!("Failed to request to CloudPlatform; #{gke_cluster.message}")
-    end
-
-    begin
-      endpoint = gke_cluster.endpoint
-      api_url = 'https://' + endpoint
-      ca_cert = Base64.decode64(gke_cluster.master_auth.cluster_ca_certificate)
-      username = gke_cluster.master_auth.username
-      password = gke_cluster.master_auth.password
-    rescue Exception => e
-      return cluster.errored!("Can not extract the expected data; #{e}")
-    end
-
-    kubernetes_token = Ci::FetchKubernetesTokenService.new(
-      api_url, ca_cert, username, password).execute
-
-    unless kubernetes_token
-      return cluster.errored!('Failed to get a default token of kubernetes')
-    end
-
-    Ci::IntegrateClusterService.new.execute(
-      cluster, endpoint, ca_cert, kubernetes_token, username, password)
-  end
 end
diff --git a/config/routes/project.rb b/config/routes/project.rb
index a01e26b2fe3..aa0819bc41c 100644
--- a/config/routes/project.rb
+++ b/config/routes/project.rb
@@ -183,7 +183,7 @@ constraints(ProjectUrlConstrainer.new) do
         end
       end
 
-      resources :clusters, except: [:show] do
+      resources :clusters, except: [:edit] do
         collection do
           get :login
         end
diff --git a/db/migrate/20170924094327_create_gcp_clusters.rb b/db/migrate/20170924094327_create_gcp_clusters.rb
index 9aa8e537dbe..032db09e748 100644
--- a/db/migrate/20170924094327_create_gcp_clusters.rb
+++ b/db/migrate/20170924094327_create_gcp_clusters.rb
@@ -19,22 +19,19 @@ class CreateGcpClusters < ActiveRecord::Migration
       t.string :endpoint
       t.text :ca_cert
       t.string :encrypted_kubernetes_token
-      t.string :encrypted_kubernetes_token_salt
       t.string :encrypted_kubernetes_token_iv
       t.string :username
       t.string :encrypted_password
-      t.string :encrypted_password_salt
       t.string :encrypted_password_iv
 
       # GKE
       t.string :gcp_project_id, null: false
-      t.string :cluster_zone, null: false
-      t.string :cluster_name, null: false
-      t.integer :cluster_size, null: false
-      t.string :machine_type
+      t.string :gcp_cluster_zone, null: false
+      t.string :gcp_cluster_name, null: false
+      t.integer :gcp_cluster_size, null: false
+      t.string :gcp_machine_type
       t.string :gcp_operation_id
       t.string :encrypted_gcp_token
-      t.string :encrypted_gcp_token_salt
       t.string :encrypted_gcp_token_iv
 
       t.datetime_with_timezone :created_at, null: false
diff --git a/db/schema.rb b/db/schema.rb
index 62802cd20ee..4d8dca384b4 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -267,38 +267,6 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_index "ci_builds", ["updated_at"], name: "index_ci_builds_on_updated_at", using: :btree
   add_index "ci_builds", ["user_id"], name: "index_ci_builds_on_user_id", using: :btree
 
-  create_table "ci_clusters", force: :cascade do |t|
-    t.integer "project_id", null: false
-    t.integer "user_id", null: false
-    t.integer "service_id"
-    t.boolean "enabled", default: true
-    t.integer "status"
-    t.string "status_reason"
-    t.string "project_namespace"
-    t.string "endpoint"
-    t.text "ca_cert"
-    t.string "encrypted_kubernetes_token"
-    t.string "encrypted_kubernetes_token_salt"
-    t.string "encrypted_kubernetes_token_iv"
-    t.string "username"
-    t.string "encrypted_password"
-    t.string "encrypted_password_salt"
-    t.string "encrypted_password_iv"
-    t.string "gcp_project_id", null: false
-    t.string "cluster_zone", null: false
-    t.string "cluster_name", null: false
-    t.integer "cluster_size", null: false
-    t.string "machine_type"
-    t.string "gcp_operation_id"
-    t.string "encrypted_gcp_token"
-    t.string "encrypted_gcp_token_salt"
-    t.string "encrypted_gcp_token_iv"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-  end
-
-  add_index "ci_clusters", ["project_id"], name: "index_ci_clusters_on_project_id", unique: true, using: :btree
-
   create_table "ci_group_variables", force: :cascade do |t|
     t.string "key", null: false
     t.text "value"
@@ -619,20 +587,17 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.string "endpoint"
     t.text "ca_cert"
     t.string "encrypted_kubernetes_token"
-    t.string "encrypted_kubernetes_token_salt"
     t.string "encrypted_kubernetes_token_iv"
     t.string "username"
     t.string "encrypted_password"
-    t.string "encrypted_password_salt"
     t.string "encrypted_password_iv"
     t.string "gcp_project_id", null: false
-    t.string "cluster_zone", null: false
-    t.string "cluster_name", null: false
-    t.integer "cluster_size", null: false
-    t.string "machine_type"
+    t.string "gcp_cluster_zone", null: false
+    t.string "gcp_cluster_name", null: false
+    t.integer "gcp_cluster_size", null: false
+    t.string "gcp_machine_type"
     t.string "gcp_operation_id"
     t.string "encrypted_gcp_token"
-    t.string "encrypted_gcp_token_salt"
     t.string "encrypted_gcp_token_iv"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -1749,9 +1714,6 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_foreign_key "ci_builds", "ci_pipelines", column: "auto_canceled_by_id", name: "fk_a2141b1522", on_delete: :nullify
   add_foreign_key "ci_builds", "ci_stages", column: "stage_id", name: "fk_3a9eaa254d", on_delete: :cascade
   add_foreign_key "ci_builds", "projects", name: "fk_befce0568a", on_delete: :cascade
-  add_foreign_key "ci_clusters", "projects", on_delete: :cascade
-  add_foreign_key "ci_clusters", "services"
-  add_foreign_key "ci_clusters", "users"
   add_foreign_key "ci_group_variables", "namespaces", column: "group_id", name: "fk_33ae4d58d8", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedule_variables", "ci_pipeline_schedules", column: "pipeline_schedule_id", name: "fk_41c35fda51", on_delete: :cascade
   add_foreign_key "ci_pipeline_schedules", "projects", name: "fk_8ead60fcc4", on_delete: :cascade
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index aa85fcdabef..f50c99578bc 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -3,7 +3,8 @@ require 'google/apis/container_v1'
 module GoogleApi
   module CloudPlatform
     class Client < GoogleApi::Auth
-      DEFAULT_MACHINE_TYPE = 'n1-standard-1'
+      DEFAULT_MACHINE_TYPE = 'n1-standard-1'.freeze
+      SCOPE = 'https://www.googleapis.com/auth/cloud-platform'.freeze
 
       class << self
         def session_key_for_token
@@ -16,7 +17,7 @@ module GoogleApi
       end
 
       def scope
-        'https://www.googleapis.com/auth/cloud-platform'
+        SCOPE
       end
 
       def validate_token(expires_at)
@@ -35,14 +36,7 @@ module GoogleApi
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
-        begin
-          cluster = service.get_zone_cluster(project_id, zone, cluster_id)
-        rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return e
-        end
-
-        puts "#{self.class.name} - #{__callee__}: cluster: #{cluster.inspect}"
-        cluster
+        service.get_zone_cluster(project_id, zone, cluster_id)
       end
 
       def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size, machine_type:)
@@ -61,28 +55,14 @@ module GoogleApi
             }
           )
 
-        begin
-          operation = service.create_cluster(project_id, zone, request_body)
-        rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return e
-        end
-
-        puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
-        operation
+        service.create_cluster(project_id, zone, request_body)
       end
 
       def projects_zones_operations(project_id, zone, operation_id)
         service = Google::Apis::ContainerV1::ContainerService.new
         service.authorization = access_token
 
-        begin
-          operation = service.get_zone_operation(project_id, zone, operation_id)
-        rescue Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-          return e
-        end
-
-        puts "#{self.class.name} - #{__callee__}: operation: #{operation.inspect}"
-        operation
+        service.get_zone_operation(project_id, zone, operation_id)
       end
 
       def parse_operation_id(self_link)
-- 
cgit v1.2.1


From 97f1369990e3dd33e7f0632cfb0b7cffc64c3f5e Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Tue, 3 Oct 2017 16:47:52 +0100
Subject: Remove interpolated translation strings

---
 .../javascripts/sidebar/components/lock/edit_form.vue       | 13 +++++++------
 .../sidebar/components/lock/lock_issue_sidebar.vue          |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form.vue b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
index b79d357d4bb..0fa19ef7217 100644
--- a/app/assets/javascripts/sidebar/components/lock/edit_form.vue
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
@@ -39,15 +39,16 @@ export default {
   <div class="dropdown open">
     <div class="dropdown-menu sidebar-item-warning-message">
       <p class="text" v-if="isLocked">
-        {{ __(`Unlock this ${issuableDisplayName(issuableType)}?`) }}
-        <strong>{{ __('Everyone') }}</strong>
-        {{ __('will be able to comment.') }}
+        Unlock this {{ issuableDisplayName(issuableType) }}?
+        <strong>Everyone</strong>
+        will be able to comment.
       </p>
 
       <p class="text" v-else>
-        {{ __(`Lock this ${issuableDisplayName(issuableType)}? Only`) }}
-        <strong>{{ __('project members') }}</strong>
-        {{ __('will be able to comment.') }}
+        Lock this {{ issuableDisplayName(issuableType) }}?
+        Only
+        <strong>project members</strong>
+        will be able to comment
       </p>
 
       <edit-form-buttons
diff --git a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
index cc214039bdd..c4b2900e020 100644
--- a/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
+++ b/app/assets/javascripts/sidebar/components/lock/lock_issue_sidebar.vue
@@ -74,7 +74,7 @@ export default {
     </div>
 
     <div class="title hide-collapsed">
-      {{ __(`Lock ${issuableDisplayName(issuableType)}`) }}
+      Lock {{issuableDisplayName(issuableType) }}
       <button
         v-if="isEditable"
         class="pull-right lock-edit btn btn-blank"
-- 
cgit v1.2.1


From c2df22a7d3ae715539ef1e4de9b40452ed180bdf Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Tue, 3 Oct 2017 08:35:43 +0100
Subject: Adds new line for css

---
 app/assets/stylesheets/pages/clusters.scss | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/pages/clusters.scss b/app/assets/stylesheets/pages/clusters.scss
index 019ef5cb2f4..5c91579c69c 100644
--- a/app/assets/stylesheets/pages/clusters.scss
+++ b/app/assets/stylesheets/pages/clusters.scss
@@ -2,4 +2,4 @@
   .clipboard-addon {
     background-color: $white-light;
   }
-}
\ No newline at end of file
+}
-- 
cgit v1.2.1


From b3c9f8c7248574154d2c04c1756d534672d6063f Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Tue, 3 Oct 2017 18:23:25 +0100
Subject: Adjust to route change Adjust toggle status Add confirmation box Adds
 permissions checks

---
 app/assets/javascripts/clusters.js         | 48 ++++++++--------
 app/assets/javascripts/dispatcher.js       |  2 +-
 app/views/projects/clusters/show.html.haml | 89 +++++++++++++-----------------
 3 files changed, 63 insertions(+), 76 deletions(-)

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index 63ff676486b..81daa97a938 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -4,6 +4,7 @@ import axios from 'axios';
 import Poll from './lib/utils/poll';
 import { s__ } from './locale';
 import './flash';
+import { convertPermissionToBoolean } from './lib/utils/common_utils';
 
 class ClusterService {
   constructor(options = {}) {
@@ -25,8 +26,16 @@ class ClusterService {
   }
 }
 /**
- * Handles visibily toggle
- * Polls the state
+ * Cluster page has 2 separate parts:
+ * - Update form with toggle button
+ * -- Check initial state and set the toggle button
+ * -- Listen to changes
+ * -- Check permissions in order to disable
+ * -- Update cluster based on toggle status
+ *
+ * - Polling status while creating or scheduled
+ * -- Update status area with the response result
+ *
  */
 export default class ClusterEdit {
   constructor() {
@@ -37,8 +46,9 @@ export default class ClusterEdit {
         checkStatus: dataset.checkStatus,
         editPath: dataset.editPath,
       },
-      canUpdate: dataset.canUpdate,
+      canUpdate: convertPermissionToBoolean(dataset.canUpdate),
       clusterStatus: dataset.clusterStatus,
+      toggleStatus: dataset.toggleStatus,
     };
 
     this.service = new ClusterService({ endpoints: this.state.endpoints });
@@ -46,42 +56,29 @@ export default class ClusterEdit {
     this.errorContainer = document.querySelector('.js-cluster-error');
     this.successContainer = document.querySelector('.js-cluster-success');
     this.creatingContainer = document.querySelector('.js-cluster-creating');
-    this.bindEvents();
-  }
 
-  bindEvents() {
-    if (!this.canUpdate) {
-      this.disableToggle();
-    }
+    this.initEditForm();
 
-    if (this.clusterStatus) {
-      // update to enable or disabled!
+    if (this.clusterStatus === 'scheduled' || this.clusterStatus === 'creating') {
+      this.initPoling();
     }
+  }
 
+  initEditForm() {
     this.toggleButton.addEventListener('click', this.toggle.bind(this));
-
     document.querySelector('.js-edit-cluster-button').addEventListener('click', this.updateData.bind(this));
-
-    this.initPoling();
   }
 
   toggle() {
     this.toggleButton.classList.toggle('checked');
-    this.toggleStatus = this.toggleButton.classList.contains('checked').toString();
+    this.state.toggleStatus = this.toggleButton.classList.contains('checked').toString();
   }
 
   updateData() {
     this.service.updateData(this.state.toggleStatus);
   }
 
-  disableToggle(disable = true) {
-    this.toggleButton.classList.toggle('disabled', disable);
-    this.toggleButton.setAttribute('disabled', disable);
-  }
-
   initPoling() {
-    if (this.state.clusterStatus === 'created') return;
-
     this.poll = new Poll({
       resource: this.service,
       method: 'fetchData',
@@ -89,8 +86,8 @@ export default class ClusterEdit {
         const { status } = data.data;
         this.updateContainer(status);
       },
-      errorCallback: () => {
-        this.updateContainer('error');
+      errorCallback: (error) => {
+        this.updateContainer('error', error);
         Flash(s__('ClusterIntegration|Something went wrong on our end.'));
       },
     });
@@ -116,7 +113,7 @@ export default class ClusterEdit {
     this.creatingContainer.classList.add('hidden');
   }
 
-  updateContainer(status) {
+  updateContainer(status, error) {
     this.hideAll();
     switch (status) {
       case 'created':
@@ -124,6 +121,7 @@ export default class ClusterEdit {
         break;
       case 'error':
         this.errorContainer.classList.remove('hidden');
+        this.errorContainer.querySelector('.js-error-reason').textContent = error.status_reason;
         break;
       case 'creating':
         this.creatingContainer.classList.add('hidden');
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index 7131889a0a0..29f9f9710ae 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -524,7 +524,7 @@ import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
         case 'admin:impersonation_tokens:index':
           new gl.DueDateSelectors();
           break;
-        case 'projects:clusters:edit':
+        case 'projects:clusters:show':
           import(/* webpackChunkName: "clusters" */ './clusters')
             .then(cluster => new cluster.default()) // eslint-disable-line new-cap
             .catch(() => {});
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index 7d09c9e8934..ec1eabe5c57 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -1,54 +1,50 @@
 .row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json),
   edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id, format: :json),
-  can_update: 'true',
-  cluster_status: '' }}
+  can_update: can?(current_user, :update_cluster, @cluster),
+  toggle_status: @cluster.enabled? ? 'true': 'false',
+  cluster_status: @cluster.status }}
   = render 'sidebar'
   .col-lg-8
     %h4.prepend-top-0
       = s_('ClusterIntegration|Enable cluster integration')
     %p
-      -#TODO: if  can?(current_user, :update_cluster, @cluster)
-      -#  if :enabled
-      = s_('ClusterIntegration|Disabling cluster integration will not affect your cluster. It will only temporarily turn off GitLab\'s conection to it.')
-      -# else
-      = s_('ClusterIntegration|Missing test/state in mockups.')
-      -# else !can?(current_user, :update_cluster, @cluster)
-      -# if :enabled
-      = s_('ClusterIntegration|Cluster integration is enabled for this project.')
-      -# else
-      = s_('ClusterIntegration|Cluster integration is disabled for this project.')
+      - if @cluster.enabled?
+        - if can?(current_user, :update_cluster, @cluster)
+          = s_('ClusterIntegration|Cluster integration is enabled for this project. Disabling this integration will not affect your cluster, it will only temporarily turn off GitLab\'s connection to it.')
+        - else
+          = s_('ClusterIntegration|Cluster integration is enabled for this project.')
+      - else
+        = s_('ClusterIntegration|Cluster integration is disabled for this project.')
 
     %label.toggle-wrapper
-      %button{ type: 'button', class: 'js-toggle-cluster project-feature-toggle', 'aria-label': 'Toggle', data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
+      %button{ type: 'button',
+        class: "js-toggle-cluster project-feature-toggle #{'checked' unless !@cluster.enabled?} #{'disabled' unless can?(current_user, :update_cluster, @cluster)}",
+        'aria-label': 'Toggle',
+        disabled: !can?(current_user, :update_cluster, @cluster),
+        data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
 
-    -# if can?(current_user, :update_cluster, @cluster)
-    .form-group
-      %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
-        = s_('ClusterIntegration|Save changes')
+    - if can?(current_user, :update_cluster, @cluster)
+      .form-group
+        %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
+          = s_('ClusterIntegration|Save changes')
 
 
-    -# if can?(current_user, :update_cluster, @cluster)
-    .form_group
-      %label
-        = s_('ClusterIntegration|Google container engine')
+    - if can?(current_user, :update_cluster, @cluster) && @cluster.scheduled? || @cluster.creating?
+      .form_group
+        %label
+          = s_('ClusterIntegration|Google container engine')
+          %p
+            - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), '', target: '_blank', rel: 'noopener noreferrer')
+            = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
-        - link_gke = link_to(s_('ClusterIntegration|Manage your cluster on GKE'), '', target: '_blank', rel: 'noopener noreferrer')
-      .hidden.js-cluster-error
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+      .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
+        = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+        %code.js-error-reason
 
-      .hidden.js-cluster-success
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+      .hidden.js-cluster-success.alert.alert-info{ role: 'alert' }
+        = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
 
-      .hidden.js-cluster-creating
-        %p
-          = s_('ClusterIntegration|This cluster was set up on Google Container Engine. %{link_gke}').html_safe % { link_gke: link_gke }
-        .alert.alert-info{ role: 'alert' }
+      .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
         = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
     .form_group
@@ -60,17 +56,10 @@
           = clipboard_button(text: @cluster.gcp_cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
 
     %br
-    -# - if can?(current_user, :admin_cluster, @cluster)
-    .well.form_group
-      %label.text-danger
-        = s_('ClusterIntegration|Remove cluster integration')
-      %p
-        = s_('ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project.')
-      = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger')
-
-
-
-%br
-= link_to "Enable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :put
-%br
-= link_to "Disable", namespace_project_cluster_path(@project.namespace, @project, @cluster.id, cluster: {enabled: 'false'}), method: :put
+    - if can?(current_user, :admin_cluster, @cluster)
+      .well.form_group
+        %label.text-danger
+          = s_('ClusterIntegration|Remove cluster integration')
+        %p
+          = s_('ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project.')
+        = link_to(s_('ClusterIntegration|Remove integration'), namespace_project_cluster_path(@project.namespace, @project, @cluster.id), method: :delete, class: 'btn btn-danger', data: { confirm: "Are you sure you want to remove cluster integration from this project? This will not delete your cluster on Google Container Engine"})
-- 
cgit v1.2.1


From 1ce09b6ed5a1d8eb00c2103e9b1595877a636be1 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 02:33:37 +0900
Subject: Introduce manage_cluster queue for sidekiq workers

---
 app/workers/cluster_creation_worker.rb          |  2 +-
 app/workers/concerns/cluster_queue.rb           | 10 ++++++++++
 app/workers/wait_for_cluster_creation_worker.rb |  2 +-
 config/sidekiq_queues.yml                       |  3 +--
 4 files changed, 13 insertions(+), 4 deletions(-)
 create mode 100644 app/workers/concerns/cluster_queue.rb

diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
index 220519134b9..d4ca9029a91 100644
--- a/app/workers/cluster_creation_worker.rb
+++ b/app/workers/cluster_creation_worker.rb
@@ -1,6 +1,6 @@
 class ClusterCreationWorker
   include Sidekiq::Worker
-  include DedicatedSidekiqQueue
+  include ClusterQueue
 
   def perform(cluster_id)
     Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
diff --git a/app/workers/concerns/cluster_queue.rb b/app/workers/concerns/cluster_queue.rb
new file mode 100644
index 00000000000..736ae90303c
--- /dev/null
+++ b/app/workers/concerns/cluster_queue.rb
@@ -0,0 +1,10 @@
+##
+# Concern for setting Sidekiq settings for the various Gcp clusters workers.
+#
+module ClusterQueue
+  extend ActiveSupport::Concern
+
+  included do
+    sidekiq_options queue: :manage_cluster
+  end
+end
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index d1f9b4e07f4..3b9978e986a 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -1,6 +1,6 @@
 class WaitForClusterCreationWorker
   include Sidekiq::Worker
-  include DedicatedSidekiqQueue
+  include ClusterQueue
 
   INITIAL_INTERVAL = 2.minutes
   EAGER_INTERVAL = 10.seconds
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 1af90d0a361..c60a2baf940 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -62,5 +62,4 @@
   - [update_user_activity, 1]
   - [propagate_service_template, 1]
   - [background_migration, 1]
-  - [cluster_creation, 1]
-  - [wait_for_cluster_creation, 1]
+  - [manage_cluster, 1]
-- 
cgit v1.2.1


From 2507652084b7ca397574878538384edcbad68c73 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:21:54 +0200
Subject: Introduce serializer for ClusterEntity

---
 app/controllers/projects/clusters_controller.rb | 31 +++++++++++++++++--------
 app/serializers/cluster_entity.rb               |  6 +++++
 app/serializers/cluster_serializer.rb           |  7 ++++++
 3 files changed, 34 insertions(+), 10 deletions(-)
 create mode 100644 app/serializers/cluster_entity.rb
 create mode 100644 app/serializers/cluster_serializer.rb

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 1b6165def51..8d07f695e78 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -46,10 +46,9 @@ class Projects::ClustersController < Projects::ApplicationController
       format.json do
         Gitlab::PollingInterval.set_header(response, interval: 10_000)
 
-        render json: {
-          status: cluster.status, # The current status of the operation.
-          status_reason: cluster.status_reason # If an error has occurred, a textual description of the error.
-        }
+        render json: ClusterSerializer
+          .new(project: @project, current_user: @current_user)
+          .represent_status(@cluster)
       end
     end
   end
@@ -62,7 +61,15 @@ class Projects::ClustersController < Projects::ApplicationController
       .new(project, current_user, cluster_params)
       .execute(cluster)
 
-    render :show
+    respond_to do |format|
+      format.html do
+        render :show
+      end
+
+      format.json do
+        head :no_data
+      end
+    end
   end
 
   def destroy
@@ -80,9 +87,13 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def cluster_params
-    params.require(:cluster)
-      .permit(:gcp_project_id, :gcp_cluster_zone, :gcp_cluster_name, :gcp_cluster_size,
-              :gcp_machine_type, :project_namespace, :enabled)
+    params.require(:cluster).permit(:gcp_project_id,
+      :gcp_cluster_zone,
+      :gcp_cluster_name,
+      :gcp_cluster_size,
+      :gcp_machine_type,
+      :project_namespace,
+      :enabled)
   end
 
   def authorize_google_api
@@ -103,10 +114,10 @@ class Projects::ClustersController < Projects::ApplicationController
   end
 
   def authorize_update_cluster!
-    return access_denied! unless can?(current_user, :update_cluster, cluster)
+    access_denied! unless can?(current_user, :update_cluster, cluster)
   end
 
   def authorize_admin_cluster!
-    return access_denied! unless can?(current_user, :admin_cluster, cluster)
+    access_denied! unless can?(current_user, :admin_cluster, cluster)
   end
 end
diff --git a/app/serializers/cluster_entity.rb b/app/serializers/cluster_entity.rb
new file mode 100644
index 00000000000..ca0ee8952e2
--- /dev/null
+++ b/app/serializers/cluster_entity.rb
@@ -0,0 +1,6 @@
+class ClusterEntity < Grape::Entity
+  include RequestAwareEntity
+
+  expose :status
+  expose :status_reason
+end
diff --git a/app/serializers/cluster_serializer.rb b/app/serializers/cluster_serializer.rb
new file mode 100644
index 00000000000..2c87202a105
--- /dev/null
+++ b/app/serializers/cluster_serializer.rb
@@ -0,0 +1,7 @@
+class ClusterSerializer < BaseSerializer
+  entity ClusterEntity
+
+  def represent_status(resource)
+    represent(resource, { only: [:status, :status_reason] })
+  end
+end
-- 
cgit v1.2.1


From 25a1ef69333280201bf745192e178f5a8e3f9165 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:22:35 +0200
Subject: Introduce policy check for clusters navigation option

---
 app/helpers/projects_helper.rb                   |  1 +
 app/views/layouts/nav/sidebar/_project.html.haml | 10 +++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 4c0cce54527..20e050195ea 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -293,6 +293,7 @@ module ProjectsHelper
       snippets:         :read_project_snippet,
       settings:         :admin_project,
       builds:           :read_build,
+      clusters:         :read_cluster,
       labels:           :read_label,
       issues:           :read_issue,
       project_members:  :read_project_member,
diff --git a/app/views/layouts/nav/sidebar/_project.html.haml b/app/views/layouts/nav/sidebar/_project.html.haml
index ed032b145da..c750da4822a 100644
--- a/app/views/layouts/nav/sidebar/_project.html.haml
+++ b/app/views/layouts/nav/sidebar/_project.html.haml
@@ -189,11 +189,11 @@
                   %span
                     Charts
 
-            -# - if project_nav_tab? :clusters TODO @shinya @ayufan
-            = nav_link(controller: :clusters) do
-              = link_to project_clusters_path(@project), title: 'Clusters', class: 'shortcuts-clusters' do
-                %span
-                  Clusters
+            - if project_nav_tab? :clusters
+              = nav_link(controller: :clusters) do
+                = link_to project_clusters_path(@project), title: 'Clusters', class: 'shortcuts-clusters' do
+                  %span
+                    Clusters
 
       - if project_nav_tab? :wiki
         = nav_link(controller: :wikis) do
-- 
cgit v1.2.1


From e8e2a2103a806873f338da4b1de21a3df9c65502 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:24:32 +0200
Subject: Rename to ClusterProvisionWorker and
 CreateGkeClusterService.new.execute

---
 app/services/ci/create_cluster_service.rb     |  2 +-
 app/services/ci/create_gke_cluster_service.rb | 37 ---------------------------
 app/services/ci/provision_cluster_service.rb  | 37 +++++++++++++++++++++++++++
 app/workers/cluster_creation_worker.rb        | 10 --------
 app/workers/cluster_provision_worker.rb       | 10 ++++++++
 5 files changed, 48 insertions(+), 48 deletions(-)
 delete mode 100644 app/services/ci/create_gke_cluster_service.rb
 create mode 100644 app/services/ci/provision_cluster_service.rb
 delete mode 100644 app/workers/cluster_creation_worker.rb
 create mode 100644 app/workers/cluster_provision_worker.rb

diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index 2fb6df9d669..179dfa0c6bb 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -7,7 +7,7 @@ module Ci
         params.merge(user: current_user,
                      status: Gcp::Cluster.statuses[:scheduled],
                      gcp_token: access_token)).tap do |cluster|
-        ClusterCreationWorker.perform_async(cluster.id) if cluster.persisted?
+        ClusterProvisionWorker.perform_async(cluster.id) if cluster.persisted?
       end
     end
   end
diff --git a/app/services/ci/create_gke_cluster_service.rb b/app/services/ci/create_gke_cluster_service.rb
deleted file mode 100644
index 2407de5fc75..00000000000
--- a/app/services/ci/create_gke_cluster_service.rb
+++ /dev/null
@@ -1,37 +0,0 @@
-module Ci
-  class CreateGkeClusterService
-    def execute(cluster)
-      api_client =
-        GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
-
-      begin
-        operation = api_client.projects_zones_clusters_create(
-            cluster.gcp_project_id,
-            cluster.gcp_cluster_zone,
-            cluster.gcp_cluster_name,
-            cluster.gcp_cluster_size,
-            machine_type: cluster.gcp_machine_type
-          )
-      rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
-      end
-        
-      unless operation.status == 'RUNNING' || operation.status == 'PENDING'
-        return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
-      end
-
-      operation_id = api_client.parse_operation_id(operation.self_link)
-
-      unless operation_id
-        return cluster.errored!('Can not find operation_id from self_link')
-      end
-
-      if cluster.creating!(operation_id)
-        WaitForClusterCreationWorker.perform_in(
-          WaitForClusterCreationWorker::INITIAL_INTERVAL, cluster.id)
-      else
-        return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
-      end
-    end
-  end
-end
diff --git a/app/services/ci/provision_cluster_service.rb b/app/services/ci/provision_cluster_service.rb
new file mode 100644
index 00000000000..3e7e565b361
--- /dev/null
+++ b/app/services/ci/provision_cluster_service.rb
@@ -0,0 +1,37 @@
+module Ci
+  class ProvisionClusterService
+    def execute(cluster)
+      api_client =
+        GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
+
+      begin
+        operation = api_client.projects_zones_clusters_create(
+            cluster.gcp_project_id,
+            cluster.gcp_cluster_zone,
+            cluster.gcp_cluster_name,
+            cluster.gcp_cluster_size,
+            machine_type: cluster.gcp_machine_type
+          )
+      rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
+        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+      end
+
+      unless operation.status == 'RUNNING' || operation.status == 'PENDING'
+        return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
+      end
+
+      cluster.gcp_operation_id = api_client.parse_operation_id(operation.self_link)
+
+      unless cluster.gcp_operation_id
+        return cluster.errored!('Can not find operation_id from self_link')
+      end
+
+      if cluster.creating
+        WaitForClusterCreationWorker.perform_in(
+          WaitForClusterCreationWorker::INITIAL_INTERVAL, cluster.id)
+      else
+        return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
+      end
+    end
+  end
+end
diff --git a/app/workers/cluster_creation_worker.rb b/app/workers/cluster_creation_worker.rb
deleted file mode 100644
index d4ca9029a91..00000000000
--- a/app/workers/cluster_creation_worker.rb
+++ /dev/null
@@ -1,10 +0,0 @@
-class ClusterCreationWorker
-  include Sidekiq::Worker
-  include ClusterQueue
-
-  def perform(cluster_id)
-    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
-      Ci::CreateGkeClusterService.new.execute(cluster)
-    end
-  end
-end
diff --git a/app/workers/cluster_provision_worker.rb b/app/workers/cluster_provision_worker.rb
new file mode 100644
index 00000000000..63300b58a25
--- /dev/null
+++ b/app/workers/cluster_provision_worker.rb
@@ -0,0 +1,10 @@
+class ClusterProvisionWorker
+  include Sidekiq::Worker
+  include ClusterQueue
+
+  def perform(cluster_id)
+    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
+      Ci::ProvisionClusterService.new.execute(cluster)
+    end
+  end
+end
-- 
cgit v1.2.1


From f916424381c1e56f7975af488dc404051a827144 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:25:03 +0200
Subject: Fix HAML permission check for ability to update clusters

---
 app/views/projects/clusters/show.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index ec1eabe5c57..3643ba40ee7 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -29,7 +29,7 @@
           = s_('ClusterIntegration|Save changes')
 
 
-    - if can?(current_user, :update_cluster, @cluster) && @cluster.scheduled? || @cluster.creating?
+    - if can?(current_user, :update_cluster, @cluster) && @cluster.on_creation?
       .form_group
         %label
           = s_('ClusterIntegration|Google container engine')
-- 
cgit v1.2.1


From 7e3e8ae81b7d20db718ff3b3afb27e6b92496af7 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:25:23 +0200
Subject: Prefer to use `.tap` as `.try` hides an exceptions from workers

---
 app/workers/wait_for_cluster_creation_worker.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index 3b9978e986a..aa1cd84fa8c 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -7,11 +7,11 @@ class WaitForClusterCreationWorker
   TIMEOUT = 20.minutes
 
   def perform(cluster_id)
-    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
+    Gcp::Cluster.find_by_id(cluster_id).tap do |cluster|
       Ci::FetchGcpOperationService.new.execute(cluster) do |operation|
         case operation.status
         when 'RUNNING'
-          if TIMEOUT < Time.now - operation.start_time.to_time
+          if TIMEOUT < Time.zone.now - operation.start_time.to_time
             return cluster.errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
           end
 
-- 
cgit v1.2.1


From c471430a13c79a82555ee171fecdf45b882a3c19 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 3 Oct 2017 23:26:26 +0200
Subject: Gcp::Cluster improvements

- introduce state machine
- use before transitions to clear data
- introduce namespace validation
---
 app/models/gcp/cluster.rb                    | 63 +++++++++++++++-------------
 app/services/ci/integrate_cluster_service.rb | 10 ++++-
 2 files changed, 42 insertions(+), 31 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 8b39bedad55..543505c24c2 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -22,49 +22,52 @@ module Gcp
       algorithm: 'aes-256-cbc'
 
     enum status: {
-      unknown: nil,
       scheduled: 1,
       creating: 2,
       created: 3,
       errored: 4
     }
 
+    state_machine :status, initial: :scheduled do
+      event :creating do
+        transition any - [:creating] => :creating
+      end
+
+      event :created do
+        transition any - [:created] => :created
+      end
+
+      event :errored do
+        transition any - [:errored] => :errored
+      end
+
+      before_transition any => [:errored, :created] do |cluster|
+        cluster.gcp_token = nil
+        cluster.gcp_operation_id = nil
+      end
+
+      before_transition any => [:errored] do |cluster|
+        status_reason = transition.args.first
+        cluster.status_reason = status_reason
+      end
+    end
+
     validates :gcp_project_id, presence: true
     validates :gcp_cluster_zone, presence: true
     validates :gcp_cluster_name, presence: true
     validates :gcp_cluster_size, presence: true,
               numericality: { only_integer: true, greater_than: 0 }
-    validate :restrict_modification, on: :update
-
-    def errored!(reason)
-      self.status = :errored
-      self.status_reason = reason
-      self.gcp_token = nil
-
-      save!(validate: false)
-    end
-
-    def creating!(gcp_operation_id)
-      self.status = :creating
-      self.gcp_operation_id = gcp_operation_id
 
-      save!(validate: false)
-    end
+    validates :project_namespace,
+      allow_blank: true,
+      length: 1..63,
+      format: {
+        with: Gitlab::Regex.kubernetes_namespace_regex,
+        message: Gitlab::Regex.kubernetes_namespace_regex_message
+      }
 
-    def created!(endpoint, ca_cert, kubernetes_token, username, password)
-      self.status = :created
-      self.enabled = true
-      self.endpoint = endpoint
-      self.ca_cert = ca_cert
-      self.kubernetes_token = kubernetes_token
-      self.username = username
-      self.password = password
-      self.service = project.find_or_initialize_service('kubernetes')
-      self.gcp_token = nil
-      self.gcp_operation_id = nil
-
-      save!
-    end
+    # if we do not do status transition we prevent change
+    validate :restrict_modification, on: :update, unless: :status_changed?
 
     def on_creation?
       scheduled? || creating?
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index c60d3722373..959c425fe74 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -2,7 +2,15 @@ module Ci
   class IntegrateClusterService
     def execute(cluster, endpoint, ca_cert, token, username, password)
       Gcp::Cluster.transaction do
-        cluster.created!(endpoint, ca_cert, token, username, password)
+        cluster.update!(
+          enabled: true,
+          endpoint: endpoint,
+          ca_cert: ca_cert,
+          kubernetes_token: token,
+          username: username,
+          password: password,
+          service: project.find_or_initialize_service('kubernetes'),
+          status_event: :created)
 
         cluster.service.update!(
           active: true,
-- 
cgit v1.2.1


From c6d53250de7f439bc25740913d85ada6e3b2fed4 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 00:20:47 +0200
Subject: Specify defaults, fix policies, fix db columns

---
 app/models/gcp/cluster.rb                        | 52 ++++++++++++++++--------
 app/policies/gcp/cluster_policy.rb               |  6 +--
 app/services/ci/integrate_cluster_service.rb     |  2 +-
 app/views/projects/clusters/_form.html.haml      |  2 +-
 app/views/projects/clusters/show.html.haml       | 19 +++++----
 app/workers/concerns/cluster_queue.rb            |  2 +-
 config/sidekiq_queues.yml                        |  2 +-
 db/migrate/20170924094327_create_gcp_clusters.rb | 12 +++---
 db/schema.rb                                     | 18 ++++----
 9 files changed, 67 insertions(+), 48 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 543505c24c2..74644207afd 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -6,6 +6,10 @@ module Gcp
     belongs_to :user
     belongs_to :service
 
+    default_value_for :gcp_cluster_zone, 'us-central1-a'
+    default_value_for :gcp_cluster_size, 3
+    default_value_for :gcp_machine_type, 'n1-standard-4'
+
     attr_encrypted :password,
       mode: :per_attribute_iv,
       key: Gitlab::Application.secrets.db_key_base,
@@ -28,6 +32,35 @@ module Gcp
       errored: 4
     }
 
+    validates :gcp_project_id,
+      length: 1..63,
+      format: {
+        with: Gitlab::Regex.kubernetes_namespace_regex,
+        message: Gitlab::Regex.kubernetes_namespace_regex_message
+      }
+
+    validates :gcp_cluster_name,
+      length: 1..63,
+      format: {
+        with: Gitlab::Regex.kubernetes_namespace_regex,
+        message: Gitlab::Regex.kubernetes_namespace_regex_message
+      }
+
+    validates :gcp_cluster_zone, presence: true
+    validates :gcp_cluster_size, presence: true,
+              numericality: { only_integer: true, greater_than: 0 }
+
+    validates :project_namespace,
+      allow_blank: true,
+      length: 1..63,
+      format: {
+        with: Gitlab::Regex.kubernetes_namespace_regex,
+        message: Gitlab::Regex.kubernetes_namespace_regex_message
+      }
+
+    # if we do not do status transition we prevent change
+    validate :restrict_modification, on: :update, unless: :status_changed?
+
     state_machine :status, initial: :scheduled do
       event :creating do
         transition any - [:creating] => :creating
@@ -52,22 +85,9 @@ module Gcp
       end
     end
 
-    validates :gcp_project_id, presence: true
-    validates :gcp_cluster_zone, presence: true
-    validates :gcp_cluster_name, presence: true
-    validates :gcp_cluster_size, presence: true,
-              numericality: { only_integer: true, greater_than: 0 }
-
-    validates :project_namespace,
-      allow_blank: true,
-      length: 1..63,
-      format: {
-        with: Gitlab::Regex.kubernetes_namespace_regex,
-        message: Gitlab::Regex.kubernetes_namespace_regex_message
-      }
-
-    # if we do not do status transition we prevent change
-    validate :restrict_modification, on: :update, unless: :status_changed?
+    def project_namespace_placeholder
+      "#{project.path}-#{project.id}"
+    end
 
     def on_creation?
       scheduled? || creating?
diff --git a/app/policies/gcp/cluster_policy.rb b/app/policies/gcp/cluster_policy.rb
index dd0a5bff146..e77173ea6e1 100644
--- a/app/policies/gcp/cluster_policy.rb
+++ b/app/policies/gcp/cluster_policy.rb
@@ -4,11 +4,7 @@ module Gcp
 
     delegate { @subject.project }
 
-    condition(:safe_to_change) do
-      can?(:master_access) && !cluster.on_creation?
-    end
-
-    rule { safe_to_change }.policy do
+    rule { can?(:master_access) }.policy do
       enable :update_cluster
       enable :admin_cluster
     end
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index 959c425fe74..ae7dccb0f42 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -9,7 +9,7 @@ module Ci
           kubernetes_token: token,
           username: username,
           password: password,
-          service: project.find_or_initialize_service('kubernetes'),
+          service: cluster.project.find_or_initialize_service('kubernetes'),
           status_event: :created)
 
         cluster.service.update!(
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index a59c48b2c68..c9ec25d2072 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -26,7 +26,7 @@
 
         .form-group
           = field.label :project_namespace
-          = field.text_field :project_namespace, class: 'form-control'
+          = field.text_field :project_namespace, class: 'form-control', placeholder: @cluster.project_namespace_placeholder
 
         .form-group
           = field.label :gcp_machine_type
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index 3643ba40ee7..d7839504f32 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -29,7 +29,7 @@
           = s_('ClusterIntegration|Save changes')
 
 
-    - if can?(current_user, :update_cluster, @cluster) && @cluster.on_creation?
+    - if can?(current_user, :admin_cluster, @cluster)
       .form_group
         %label
           = s_('ClusterIntegration|Google container engine')
@@ -37,15 +37,18 @@
             - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), '', target: '_blank', rel: 'noopener noreferrer')
             = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
-      .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
-        = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
-        %code.js-error-reason
+      - if @cluster.errored?
+        .js-cluster-error.alert.alert-danger{ role: 'alert' }
+          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+          %code.js-error-reason
 
-      .hidden.js-cluster-success.alert.alert-info{ role: 'alert' }
-        = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+      - if @cluster.on_creation?
+        .js-cluster-creating.alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
-      .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
-        = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
+      - if @cluster.created?
+        .js-cluster-success.alert.alert-info{ role: 'alert' }
+          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
 
     .form_group
       %label
diff --git a/app/workers/concerns/cluster_queue.rb b/app/workers/concerns/cluster_queue.rb
index 736ae90303c..a5074d13220 100644
--- a/app/workers/concerns/cluster_queue.rb
+++ b/app/workers/concerns/cluster_queue.rb
@@ -5,6 +5,6 @@ module ClusterQueue
   extend ActiveSupport::Concern
 
   included do
-    sidekiq_options queue: :manage_cluster
+    sidekiq_options queue: :gcp_cluster
   end
 end
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 74a08b3f086..e2bb766ee47 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -62,6 +62,6 @@
   - [update_user_activity, 1]
   - [propagate_service_template, 1]
   - [background_migration, 1]
-  - [manage_cluster, 1]
+  - [gcp_cluster, 1]
   - [project_migrate_hashed_storage, 1]
   - [storage_migrator, 1]
diff --git a/db/migrate/20170924094327_create_gcp_clusters.rb b/db/migrate/20170924094327_create_gcp_clusters.rb
index 032db09e748..42171be7fc4 100644
--- a/db/migrate/20170924094327_create_gcp_clusters.rb
+++ b/db/migrate/20170924094327_create_gcp_clusters.rb
@@ -4,13 +4,13 @@ class CreateGcpClusters < ActiveRecord::Migration
   def change
     create_table :gcp_clusters do |t|
       t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
-      t.references :user, null: false, foreign_key: true
-      t.references :service, foreign_key: true
+      t.references :user, foreign_key: { on_delete: :nullify }
+      t.references :service, foreign_key: { on_delete: :nullify }
 
       # General
       t.boolean :enabled, default: true
       t.integer :status
-      t.string :status_reason
+      t.text :status_reason
 
       # k8s integration specific
       t.string :project_namespace
@@ -18,10 +18,10 @@ class CreateGcpClusters < ActiveRecord::Migration
       # Cluster details
       t.string :endpoint
       t.text :ca_cert
-      t.string :encrypted_kubernetes_token
+      t.text :encrypted_kubernetes_token
       t.string :encrypted_kubernetes_token_iv
       t.string :username
-      t.string :encrypted_password
+      t.text :encrypted_password
       t.string :encrypted_password_iv
 
       # GKE
@@ -31,7 +31,7 @@ class CreateGcpClusters < ActiveRecord::Migration
       t.integer :gcp_cluster_size, null: false
       t.string :gcp_machine_type
       t.string :gcp_operation_id
-      t.string :encrypted_gcp_token
+      t.text :encrypted_gcp_token
       t.string :encrypted_gcp_token_iv
 
       t.datetime_with_timezone :created_at, null: false
diff --git a/db/schema.rb b/db/schema.rb
index 9fc8191751c..0056fe7a09f 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -577,18 +577,18 @@ ActiveRecord::Schema.define(version: 20170928100231) do
 
   create_table "gcp_clusters", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.integer "user_id", null: false
+    t.integer "user_id"
     t.integer "service_id"
     t.boolean "enabled", default: true
     t.integer "status"
-    t.string "status_reason"
+    t.text "status_reason"
     t.string "project_namespace"
     t.string "endpoint"
     t.text "ca_cert"
-    t.string "encrypted_kubernetes_token"
+    t.text "encrypted_kubernetes_token"
     t.string "encrypted_kubernetes_token_iv"
     t.string "username"
-    t.string "encrypted_password"
+    t.text "encrypted_password"
     t.string "encrypted_password_iv"
     t.string "gcp_project_id", null: false
     t.string "gcp_cluster_zone", null: false
@@ -596,10 +596,10 @@ ActiveRecord::Schema.define(version: 20170928100231) do
     t.integer "gcp_cluster_size", null: false
     t.string "gcp_machine_type"
     t.string "gcp_operation_id"
-    t.string "encrypted_gcp_token"
+    t.text "encrypted_gcp_token"
     t.string "encrypted_gcp_token_iv"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
   end
 
   add_index "gcp_clusters", ["project_id"], name: "index_gcp_clusters_on_project_id", unique: true, using: :btree
@@ -1752,8 +1752,8 @@ ActiveRecord::Schema.define(version: 20170928100231) do
   add_foreign_key "events", "users", column: "author_id", name: "fk_edfd187b6f", on_delete: :cascade
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
   add_foreign_key "gcp_clusters", "projects", on_delete: :cascade
-  add_foreign_key "gcp_clusters", "services"
-  add_foreign_key "gcp_clusters", "users"
+  add_foreign_key "gcp_clusters", "services", on_delete: :nullify
+  add_foreign_key "gcp_clusters", "users", on_delete: :nullify
   add_foreign_key "gpg_keys", "users", on_delete: :cascade
   add_foreign_key "gpg_signatures", "gpg_keys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "projects", on_delete: :cascade
-- 
cgit v1.2.1


From 20abcbffae71f8177223f2b978c8ad56102da271 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 16:04:45 +0900
Subject: Add google_api to TOP_LEVEL_ROUTES. Import/Export model failure fix.
 Fix static analysys.

---
 app/controllers/projects/clusters_controller.rb      |  5 ++---
 app/models/gcp/cluster.rb                            |  2 +-
 app/services/ci/fetch_gcp_operation_service.rb       |  2 +-
 app/services/ci/finalize_cluster_creation_service.rb |  2 +-
 app/services/ci/provision_cluster_service.rb         | 11 +++++------
 lib/gitlab/import_export/import_export.yml           |  1 +
 lib/gitlab/import_export/relation_factory.rb         |  1 +
 lib/gitlab/path_regex.rb                             |  1 +
 lib/google_api/auth.rb                               |  2 +-
 lib/google_api/cloud_platform/client.rb              | 15 +++++++--------
 spec/lib/gitlab/import_export/all_models.yml         |  5 +++++
 11 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 8d07f695e78..5dbabaf7813 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -9,9 +9,8 @@ class Projects::ClustersController < Projects::ApplicationController
   def login
     begin
       @authorize_url = GoogleApi::CloudPlatform::Client.new(
-          nil, callback_google_api_authorizations_url,
-          state: namespace_project_clusters_url.to_s
-        ).authorize_url
+        nil, callback_google_api_authorizations_url,
+        state: namespace_project_clusters_url.to_s).authorize_url
     rescue GoogleApi::Auth::ConfigMissingError
       # no-op
     end
diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 74644207afd..81af8161b8f 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -48,7 +48,7 @@ module Gcp
 
     validates :gcp_cluster_zone, presence: true
     validates :gcp_cluster_size, presence: true,
-              numericality: { only_integer: true, greater_than: 0 }
+      numericality: { only_integer: true, greater_than: 0 }
 
     validates :project_namespace,
       allow_blank: true,
diff --git a/app/services/ci/fetch_gcp_operation_service.rb b/app/services/ci/fetch_gcp_operation_service.rb
index 24892d1ab47..415afaf901f 100644
--- a/app/services/ci/fetch_gcp_operation_service.rb
+++ b/app/services/ci/fetch_gcp_operation_service.rb
@@ -1,7 +1,7 @@
 module Ci
   class FetchGcpOperationService
     def execute(cluster)
-      api_client = 
+      api_client =
         GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
 
       operation = api_client.projects_zones_operations(
diff --git a/app/services/ci/finalize_cluster_creation_service.rb b/app/services/ci/finalize_cluster_creation_service.rb
index 03cd761deb7..a469acc0467 100644
--- a/app/services/ci/finalize_cluster_creation_service.rb
+++ b/app/services/ci/finalize_cluster_creation_service.rb
@@ -1,7 +1,7 @@
 module Ci
   class FinalizeClusterCreationService
     def execute(cluster)
-      api_client = 
+      api_client =
         GoogleApi::CloudPlatform::Client.new(cluster.gcp_token, nil)
 
       begin
diff --git a/app/services/ci/provision_cluster_service.rb b/app/services/ci/provision_cluster_service.rb
index 3e7e565b361..6fcbdd8b483 100644
--- a/app/services/ci/provision_cluster_service.rb
+++ b/app/services/ci/provision_cluster_service.rb
@@ -6,12 +6,11 @@ module Ci
 
       begin
         operation = api_client.projects_zones_clusters_create(
-            cluster.gcp_project_id,
-            cluster.gcp_cluster_zone,
-            cluster.gcp_cluster_name,
-            cluster.gcp_cluster_size,
-            machine_type: cluster.gcp_machine_type
-          )
+          cluster.gcp_project_id,
+          cluster.gcp_cluster_zone,
+          cluster.gcp_cluster_name,
+          cluster.gcp_cluster_size,
+          machine_type: cluster.gcp_machine_type)
       rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
         return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
       end
diff --git a/lib/gitlab/import_export/import_export.yml b/lib/gitlab/import_export/import_export.yml
index 2171c6c7bbb..a99183fe669 100644
--- a/lib/gitlab/import_export/import_export.yml
+++ b/lib/gitlab/import_export/import_export.yml
@@ -53,6 +53,7 @@ project_tree:
   - :auto_devops
   - :triggers
   - :pipeline_schedules
+  - :clusters
   - :services
   - :hooks
   - protected_branches:
diff --git a/lib/gitlab/import_export/relation_factory.rb b/lib/gitlab/import_export/relation_factory.rb
index 380b336395d..5938b927ff0 100644
--- a/lib/gitlab/import_export/relation_factory.rb
+++ b/lib/gitlab/import_export/relation_factory.rb
@@ -8,6 +8,7 @@ module Gitlab
                     triggers: 'Ci::Trigger',
                     pipeline_schedules: 'Ci::PipelineSchedule',
                     builds: 'Ci::Build',
+                    clusters: 'Gcp::Cluster',
                     hooks: 'ProjectHook',
                     merge_access_levels: 'ProtectedBranch::MergeAccessLevel',
                     push_access_levels: 'ProtectedBranch::PushAccessLevel',
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
index 7c02c9c5c48..e68160c8faf 100644
--- a/lib/gitlab/path_regex.rb
+++ b/lib/gitlab/path_regex.rb
@@ -33,6 +33,7 @@ module Gitlab
       explore
       favicon.ico
       files
+      google_api
       groups
       health_check
       help
diff --git a/lib/google_api/auth.rb b/lib/google_api/auth.rb
index 8c962af51d7..99a82c849e0 100644
--- a/lib/google_api/auth.rb
+++ b/lib/google_api/auth.rb
@@ -46,7 +46,7 @@ module GoogleApi
         config.app_id,
         config.app_secret,
         site: 'https://accounts.google.com',
-        token_url: '/o/oauth2/token', 
+        token_url: '/o/oauth2/token',
         authorize_url: '/o/oauth2/auth'
       )
     end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index f50c99578bc..d13e3290cf5 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -44,16 +44,15 @@ module GoogleApi
         service.authorization = access_token
 
         request_body = Google::Apis::ContainerV1::CreateClusterRequest.new(
-            {
-              "cluster": {
-                "name": cluster_name,
-                "initial_node_count": cluster_size,
-                "node_config": {
-                  "machine_type": machine_type # Default 3.75 GB, if ommit
-                }
+          {
+            "cluster": {
+              "name": cluster_name,
+              "initial_node_count": cluster_size,
+              "node_config": {
+                "machine_type": machine_type
               }
             }
-          )
+          } )
 
         service.create_cluster(project_id, zone, request_body)
       end
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index 3fb8edeb701..39fbd79372e 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -147,6 +147,10 @@ deploy_keys:
 - user
 - deploy_keys_projects
 - projects
+clusters:
+- project
+- user
+- service
 services:
 - project
 - service_hook
@@ -177,6 +181,7 @@ project:
 - tag_taggings
 - tags
 - chat_services
+- cluster
 - creator
 - group
 - namespace
-- 
cgit v1.2.1


From 982c2b83ed14f72c288cfd6c719e9729a0d8818e Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 18:21:01 +0900
Subject: Fix static anlysys. Added safe_model_attributes.

---
 app/models/gcp/cluster.rb                          |  5 ++++-
 lib/gitlab/import_export/import_export.yml         |  2 +-
 lib/gitlab/import_export/relation_factory.rb       |  1 +
 .../gitlab/import_export/safe_model_attributes.yml | 26 ++++++++++++++++++++++
 4 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 81af8161b8f..8e7807a3a55 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -48,7 +48,10 @@ module Gcp
 
     validates :gcp_cluster_zone, presence: true
     validates :gcp_cluster_size, presence: true,
-      numericality: { only_integer: true, greater_than: 0 }
+      numericality: {
+        only_integer: true,
+        greater_than: 0
+      }
 
     validates :project_namespace,
       allow_blank: true,
diff --git a/lib/gitlab/import_export/import_export.yml b/lib/gitlab/import_export/import_export.yml
index a99183fe669..dec8b4c5acd 100644
--- a/lib/gitlab/import_export/import_export.yml
+++ b/lib/gitlab/import_export/import_export.yml
@@ -53,7 +53,7 @@ project_tree:
   - :auto_devops
   - :triggers
   - :pipeline_schedules
-  - :clusters
+  - :cluster
   - :services
   - :hooks
   - protected_branches:
diff --git a/lib/gitlab/import_export/relation_factory.rb b/lib/gitlab/import_export/relation_factory.rb
index 5938b927ff0..a76cf1addc0 100644
--- a/lib/gitlab/import_export/relation_factory.rb
+++ b/lib/gitlab/import_export/relation_factory.rb
@@ -8,6 +8,7 @@ module Gitlab
                     triggers: 'Ci::Trigger',
                     pipeline_schedules: 'Ci::PipelineSchedule',
                     builds: 'Ci::Build',
+                    cluster: 'Gcp::Cluster',
                     clusters: 'Gcp::Cluster',
                     hooks: 'ProjectHook',
                     merge_access_levels: 'ProtectedBranch::MergeAccessLevel',
diff --git a/spec/lib/gitlab/import_export/safe_model_attributes.yml b/spec/lib/gitlab/import_export/safe_model_attributes.yml
index 7268226112c..d96ea7b5417 100644
--- a/spec/lib/gitlab/import_export/safe_model_attributes.yml
+++ b/spec/lib/gitlab/import_export/safe_model_attributes.yml
@@ -310,6 +310,32 @@ Ci::PipelineSchedule:
 - deleted_at
 - created_at
 - updated_at
+Gcp::Cluster:
+- id
+- project_id
+- user_id
+- service_id
+- enabled
+- status
+- status_reason
+- project_namespace
+- endpoint
+- ca_cert
+- encrypted_kubernetes_token
+- encrypted_kubernetes_token_iv
+- username
+- encrypted_password
+- encrypted_password_iv
+- gcp_project_id
+- gcp_cluster_zone
+- gcp_cluster_name
+- gcp_cluster_size
+- gcp_machine_type
+- gcp_operation_id
+- encrypted_gcp_token
+- encrypted_gcp_token_iv
+- created_at
+- updated_at
 DeployKey:
 - id
 - user_id
-- 
cgit v1.2.1


From 8cff79bc1dd8802843f977177b433838f0ba76b0 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 20:27:25 +0900
Subject: Fix static analysys. Fix import config.

---
 app/models/gcp/cluster.rb                    | 4 +++-
 spec/lib/gitlab/import_export/all_models.yml | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 8e7807a3a55..18e16135a57 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -47,7 +47,9 @@ module Gcp
       }
 
     validates :gcp_cluster_zone, presence: true
-    validates :gcp_cluster_size, presence: true,
+
+    validates :gcp_cluster_size,
+      presence: true,
       numericality: {
         only_integer: true,
         greater_than: 0
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index 39fbd79372e..ec425fd2803 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -147,7 +147,7 @@ deploy_keys:
 - user
 - deploy_keys_projects
 - projects
-clusters:
+cluster:
 - project
 - user
 - service
-- 
cgit v1.2.1


From 5a2b43fcc6490847fae39a1dce38ce13d5860da3 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Wed, 4 Oct 2017 12:48:34 +0100
Subject: Adjustments to polling & forms

---
 app/assets/javascripts/clusters.js          | 72 +++++++++++------------------
 app/views/projects/clusters/_form.html.haml | 21 ++++-----
 app/views/projects/clusters/show.html.haml  | 59 ++++++++++++-----------
 3 files changed, 66 insertions(+), 86 deletions(-)

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index 81daa97a938..5a381a5322a 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -4,74 +4,58 @@ import axios from 'axios';
 import Poll from './lib/utils/poll';
 import { s__ } from './locale';
 import './flash';
-import { convertPermissionToBoolean } from './lib/utils/common_utils';
 
-class ClusterService {
-  constructor(options = {}) {
-    this.options = options;
-  }
-
-  fetchData() {
-    return axios.get(this.options.endpoints.checkStatus);
-  }
-
-  updateData(value) {
-    return axios.put(this.options.endpoints.editPath,
-      {
-        cluster: {
-          enabled: value,
-        },
-      },
-    );
-  }
-}
 /**
  * Cluster page has 2 separate parts:
- * - Update form with toggle button
- * -- Check initial state and set the toggle button
- * -- Listen to changes
- * -- Check permissions in order to disable
- * -- Update cluster based on toggle status
+ *   Toggle button
  *
  * - Polling status while creating or scheduled
  * -- Update status area with the response result
  *
  */
+
+class ClusterService {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  fetchData() {
+    return axios.get(this.options.endpoint);
+  }
+}
+
 export default class ClusterEdit {
   constructor() {
     const dataset = document.querySelector('.js-edit-cluster-form').dataset;
 
     this.state = {
-      endpoints: {
-        checkStatus: dataset.checkStatus,
-        editPath: dataset.editPath,
-      },
-      canUpdate: convertPermissionToBoolean(dataset.canUpdate),
+      statusPath: dataset.statusPath,
       clusterStatus: dataset.clusterStatus,
+      clusterStatusReason: dataset.clusterStatusReason,
       toggleStatus: dataset.toggleStatus,
     };
 
-    this.service = new ClusterService({ endpoints: this.state.endpoints });
+    this.service = new ClusterService({ endpoint: this.state.statusPath });
     this.toggleButton = document.querySelector('.js-toggle-cluster');
+    this.toggleInput = document.querySelector('.js-toggle-input');
     this.errorContainer = document.querySelector('.js-cluster-error');
     this.successContainer = document.querySelector('.js-cluster-success');
     this.creatingContainer = document.querySelector('.js-cluster-creating');
 
-    this.initEditForm();
+    this.toggleButton.addEventListener('click', this.toggle.bind(this));
 
-    if (this.clusterStatus === 'scheduled' || this.clusterStatus === 'creating') {
-      this.initPoling();
+    if (this.state.clusterStatus !== 'created') {
+      this.updateContainer(this.state.clusterStatus, this.state.clusterStatusReason);
     }
-  }
 
-  initEditForm() {
-    this.toggleButton.addEventListener('click', this.toggle.bind(this));
-    document.querySelector('.js-edit-cluster-button').addEventListener('click', this.updateData.bind(this));
+    if (this.state.statusPath) {
+      this.initPoling();
+    }
   }
 
   toggle() {
     this.toggleButton.classList.toggle('checked');
     this.state.toggleStatus = this.toggleButton.classList.contains('checked').toString();
+    this.toggleInput.setAttribute('value', this.state.toggleStatus);
   }
 
   updateData() {
@@ -83,11 +67,10 @@ export default class ClusterEdit {
       resource: this.service,
       method: 'fetchData',
       successCallback: (data) => {
-        const { status } = data.data;
-        this.updateContainer(status);
+        const { status, status_reason } = data.data;
+        this.updateContainer(status, status_reason);
       },
-      errorCallback: (error) => {
-        this.updateContainer('error', error);
+      errorCallback: () => {
         Flash(s__('ClusterIntegration|Something went wrong on our end.'));
       },
     });
@@ -119,12 +102,13 @@ export default class ClusterEdit {
       case 'created':
         this.successContainer.classList.remove('hidden');
         break;
-      case 'error':
+      case 'errored':
         this.errorContainer.classList.remove('hidden');
         this.errorContainer.querySelector('.js-error-reason').textContent = error.status_reason;
         break;
+      case 'scheduled':
       case 'creating':
-        this.creatingContainer.classList.add('hidden');
+        this.creatingContainer.classList.remove('hidden');
         break;
       default:
         this.hideAll();
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index c9ec25d2072..b5c4942f528 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -7,34 +7,31 @@
       = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
         = form_errors(@cluster)
         .form-group
-          = field.label :gcp_cluster_name
+          = field.label :gcp_cluster_name, s_('ClusterIntegration|Cluster name')
           = field.text_field :gcp_cluster_name, class: 'form-control'
 
         .form-group
-          = field.label :gcp_project_id
+          = field.label :gcp_project_id, s_('ClusterIntegration|Google Cloud Platform project ID')
           = link_to(s_('ClusterIntegration|See your projects'), 'https://console.cloud.google.com/home/dashboard', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :gcp_project_id, class: 'form-control'
 
         .form-group
-          = field.label :gcp_cluster_zone
+          = field.label :gcp_cluster_zone, s_('ClusterIntegration|Zone')
           = link_to(s_('ClusterIntegration|See zones'), 'https://cloud.google.com/compute/docs/regions-zones/regions-zones', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :gcp_cluster_zone, class: 'form-control'
 
         .form-group
-          = field.label :gcp_cluster_size
+          = field.label :gcp_cluster_size, s_('ClusterIntegration|Number of nodes')
           = field.text_field :gcp_cluster_size, class: 'form-control'
 
         .form-group
-          = field.label :project_namespace
-          = field.text_field :project_namespace, class: 'form-control', placeholder: @cluster.project_namespace_placeholder
-
-        .form-group
-          = field.label :gcp_machine_type
+          = field.label :gcp_machine_type, s_('ClusterIntegration|Machine type')
           = link_to(s_('ClusterIntegration|Machine type'), 'https://cloud.google.com/compute/docs/machine-types', target: '_blank', rel: 'noopener noreferrer')
           = field.text_field :gcp_machine_type, class: 'form-control'
 
+          .form-group
+          = field.label :project_namespace, s_('ClusterIntegration|Project namespace (optional, unique)')
+          = field.text_field :project_namespace, class: 'form-control', placeholder: @cluster.project_namespace_placeholder
+
         .form-group
           = field.submit s_('ClusterIntegration|Create cluster'), class: 'btn btn-save'
-
-          -# TODO: Remove before merge
-          = link_to "Create on Google Container Engine", namespace_project_clusters_path(@project.namespace, @project, cluster: {gcp_cluster_name: "gke-test-creation#{Random.rand(100)}", gcp_project_id: 'gitlab-internal-153318', gcp_cluster_zone: 'us-central1-a', gcp_cluster_size: '1', project_namespace: 'aaa', gcp_machine_type: 'n1-standard-1'}), method: :post
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index d7839504f32..9746df76365 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -1,8 +1,8 @@
-.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { check_status: status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json),
-  edit_path: namespace_project_cluster_path(@project.namespace, @project, @cluster.id, format: :json),
-  can_update: can?(current_user, :update_cluster, @cluster),
+- status_path = status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json) if can?(current_user, :admin_cluster, @cluster) && @cluster.on_creation?
+.row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { status_path: status_path,
   toggle_status: @cluster.enabled? ? 'true': 'false',
-  cluster_status: @cluster.status }}
+  cluster_status: @cluster.status,
+  cluster_status_reason: @cluster.status_reason }}
   = render 'sidebar'
   .col-lg-8
     %h4.prepend-top-0
@@ -16,39 +16,38 @@
       - else
         = s_('ClusterIntegration|Cluster integration is disabled for this project.')
 
-    %label.toggle-wrapper
-      %button{ type: 'button',
-        class: "js-toggle-cluster project-feature-toggle #{'checked' unless !@cluster.enabled?} #{'disabled' unless can?(current_user, :update_cluster, @cluster)}",
-        'aria-label': 'Toggle',
-        disabled: !can?(current_user, :update_cluster, @cluster),
-        data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
-
-    - if can?(current_user, :update_cluster, @cluster)
+    = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
+      = form_errors(@cluster)
       .form-group
-        %button{ type: 'button', class: 'js-edit-cluster-button btn btn-success'}
-          = s_('ClusterIntegration|Save changes')
+        %label.toggle-wrapper
+          = field.hidden_field :enabled, { class: 'js-toggle-input'}
+
+          %button{ type: 'button',
+            class: "js-toggle-cluster project-feature-toggle #{'checked' unless !@cluster.enabled?} #{'disabled' unless can?(current_user, :update_cluster, @cluster)}",
+            'aria-label': 'Toggle',
+            disabled: !can?(current_user, :update_cluster, @cluster),
+            data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
 
+        - if can?(current_user, :update_cluster, @cluster)
+          .form-group
+            = field.submit s_('ClusterIntegration|Save changes'), class: 'btn btn-success'
 
     - if can?(current_user, :admin_cluster, @cluster)
-      .form_group
-        %label
-          = s_('ClusterIntegration|Google container engine')
-          %p
-            - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), '', target: '_blank', rel: 'noopener noreferrer')
-            = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
+      %label
+        = s_('ClusterIntegration|Google container engine')
+      %p
+        - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), '', target: '_blank', rel: 'noopener noreferrer')
+        = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
-      - if @cluster.errored?
-        .js-cluster-error.alert.alert-danger{ role: 'alert' }
-          = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
-          %code.js-error-reason
+      .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
+        = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+        %code.js-error-reason
 
-      - if @cluster.on_creation?
-        .js-cluster-creating.alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
+      .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
+        = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
-      - if @cluster.created?
-        .js-cluster-success.alert.alert-info{ role: 'alert' }
-          = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+      .hidden.js-cluster-success.alert.alert-info{ role: 'alert' }
+        = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
 
     .form_group
       %label
-- 
cgit v1.2.1


From 7329a0347f6093a15ffb0cf8f6a9ddc7f0495cb6 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Wed, 4 Oct 2017 12:51:12 +0100
Subject: Add warning messages

---
 app/controllers/projects/clusters_controller.rb | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 5dbabaf7813..46118184993 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -60,21 +60,20 @@ class Projects::ClustersController < Projects::ApplicationController
       .new(project, current_user, cluster_params)
       .execute(cluster)
 
-    respond_to do |format|
-      format.html do
+      if cluster.valid?
+        flash[:notice] = "Cluster updated"
+        redirect_to project_cluster_path(project, project.cluster)
+      else
         render :show
       end
-
-      format.json do
-        head :no_data
-      end
-    end
   end
 
   def destroy
     if cluster.destroy
+      flash[:notice] = "Cluster removed"
       redirect_to project_clusters_path(project), status: 302
     else
+      flash[:notice] = "Cluster removed"
       render :show
     end
   end
-- 
cgit v1.2.1


From e182e8ff106dba64e7edfefca5be5cc685f084f0 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Wed, 4 Oct 2017 14:09:20 +0200
Subject: Add documentation for discussion lock

---
 .../img/discussion_lock_system_notes.png           | Bin 0 -> 50200 bytes
 doc/user/discussions/img/lock_form_member.png      | Bin 0 -> 100581 bytes
 doc/user/discussions/img/lock_form_non_member.png  | Bin 0 -> 37432 bytes
 doc/user/discussions/img/turn_off_lock.png         | Bin 0 -> 31580 bytes
 doc/user/discussions/img/turn_on_lock.png          | Bin 0 -> 34839 bytes
 doc/user/discussions/index.md                      |  30 +++++++++++++++++++++
 6 files changed, 30 insertions(+)
 create mode 100644 doc/user/discussions/img/discussion_lock_system_notes.png
 create mode 100644 doc/user/discussions/img/lock_form_member.png
 create mode 100644 doc/user/discussions/img/lock_form_non_member.png
 create mode 100644 doc/user/discussions/img/turn_off_lock.png
 create mode 100644 doc/user/discussions/img/turn_on_lock.png

diff --git a/doc/user/discussions/img/discussion_lock_system_notes.png b/doc/user/discussions/img/discussion_lock_system_notes.png
new file mode 100644
index 00000000000..8e8e8e0bc3d
Binary files /dev/null and b/doc/user/discussions/img/discussion_lock_system_notes.png differ
diff --git a/doc/user/discussions/img/lock_form_member.png b/doc/user/discussions/img/lock_form_member.png
new file mode 100644
index 00000000000..01c6308d24c
Binary files /dev/null and b/doc/user/discussions/img/lock_form_member.png differ
diff --git a/doc/user/discussions/img/lock_form_non_member.png b/doc/user/discussions/img/lock_form_non_member.png
new file mode 100644
index 00000000000..3bb70b69580
Binary files /dev/null and b/doc/user/discussions/img/lock_form_non_member.png differ
diff --git a/doc/user/discussions/img/turn_off_lock.png b/doc/user/discussions/img/turn_off_lock.png
new file mode 100644
index 00000000000..dd05b398a8b
Binary files /dev/null and b/doc/user/discussions/img/turn_off_lock.png differ
diff --git a/doc/user/discussions/img/turn_on_lock.png b/doc/user/discussions/img/turn_on_lock.png
new file mode 100644
index 00000000000..9597da4e14d
Binary files /dev/null and b/doc/user/discussions/img/turn_on_lock.png differ
diff --git a/doc/user/discussions/index.md b/doc/user/discussions/index.md
index efea99eb120..f3c51d95513 100644
--- a/doc/user/discussions/index.md
+++ b/doc/user/discussions/index.md
@@ -153,12 +153,42 @@ comments in greater detail.
 
 ![Discussion comment](img/discussion_comment.png)
 
+## Locking discussions
+
+> [Introduced][ce-14531] in GitLab 10.1.
+
+When the discussion of an issue or a merge request is locked only team members can write new comments and edit the old ones.
+
+### Modifying discussion lock
+
+To lock or unlock a dicsussion, find the Lock section in the sidebar and click **Edit**. A popup should appear and give you the option to turn on or turn off the discussion lock.
+
+| Turn off discussion lock | Turn on discussion lock |
+| :-----------: | :----------: |
+| ![Turn off discussion lock](img/turn_off_lock.png) | ![Turn on discussion lock](img/turn_on_lock.png) |
+
+Every change is indicated by a system note in the issue's or merge request's comments.
+
+![Discussion lock system notes](img/discussion_lock_system_notes.png)
+
+### Indications of locked issues or merge requests
+
+While you are inside the locked issue or merge request and you are a project team member you can see an indicator in the comment form that the issue or merge request is locked.
+
+If you are not a team member you won't see the comment form but only the information that the dicussion is locked.
+
+| Team member | Not a member |
+| :-----------: | :----------: |
+| ![Comment form member](img/lock_form_member.png) | ![Comment form non-member](img/lock_form_non_member.png) |
+
+
 [ce-5022]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022
 [ce-7125]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7125
 [ce-7527]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7527
 [ce-7180]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7180
 [ce-8266]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8266
 [ce-14053]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14053
+[ce-14531]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14531
 [resolve-discussion-button]: img/resolve_discussion_button.png
 [resolve-comment-button]: img/resolve_comment_button.png
 [discussion-view]: img/discussion_view.png
-- 
cgit v1.2.1


From ea4af856e49cf5933b6995965fa7d6b922e38c20 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 15:14:01 +0200
Subject: Fix cluster event names to be prefixed with: `make_`

---
 app/models/gcp/cluster.rb                            |  6 +++---
 app/services/ci/fetch_gcp_operation_service.rb       |  2 +-
 app/services/ci/finalize_cluster_creation_service.rb |  4 ++--
 app/services/ci/integrate_cluster_service.rb         |  2 +-
 app/services/ci/provision_cluster_service.rb         | 10 +++++-----
 app/workers/wait_for_cluster_creation_worker.rb      |  4 ++--
 6 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 18e16135a57..21eab9d8c1c 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -67,15 +67,15 @@ module Gcp
     validate :restrict_modification, on: :update, unless: :status_changed?
 
     state_machine :status, initial: :scheduled do
-      event :creating do
+      event :make_creating do
         transition any - [:creating] => :creating
       end
 
-      event :created do
+      event :make_created do
         transition any - [:created] => :created
       end
 
-      event :errored do
+      event :make_errored do
         transition any - [:errored] => :errored
       end
 
diff --git a/app/services/ci/fetch_gcp_operation_service.rb b/app/services/ci/fetch_gcp_operation_service.rb
index 415afaf901f..0b68e4d6ea9 100644
--- a/app/services/ci/fetch_gcp_operation_service.rb
+++ b/app/services/ci/fetch_gcp_operation_service.rb
@@ -11,7 +11,7 @@ module Ci
 
       yield(operation) if block_given?
     rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-      return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+      return cluster.make_errored!("Failed to request to CloudPlatform; #{e.message}")
     end
   end
 end
diff --git a/app/services/ci/finalize_cluster_creation_service.rb b/app/services/ci/finalize_cluster_creation_service.rb
index a469acc0467..347875c5697 100644
--- a/app/services/ci/finalize_cluster_creation_service.rb
+++ b/app/services/ci/finalize_cluster_creation_service.rb
@@ -10,7 +10,7 @@ module Ci
           cluster.gcp_cluster_zone,
           cluster.gcp_cluster_name)
       rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+        return cluster.make_errored!("Failed to request to CloudPlatform; #{e.message}")
       end
 
       endpoint = gke_cluster.endpoint
@@ -23,7 +23,7 @@ module Ci
         api_url, ca_cert, username, password).execute
 
       unless kubernetes_token
-        return cluster.errored!('Failed to get a default token of kubernetes')
+        return cluster.make_errored!('Failed to get a default token of kubernetes')
       end
 
       Ci::IntegrateClusterService.new.execute(
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index ae7dccb0f42..857bca3f953 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -10,7 +10,7 @@ module Ci
           username: username,
           password: password,
           service: cluster.project.find_or_initialize_service('kubernetes'),
-          status_event: :created)
+          status_event: :make_created)
 
         cluster.service.update!(
           active: true,
diff --git a/app/services/ci/provision_cluster_service.rb b/app/services/ci/provision_cluster_service.rb
index 6fcbdd8b483..52d80b01813 100644
--- a/app/services/ci/provision_cluster_service.rb
+++ b/app/services/ci/provision_cluster_service.rb
@@ -12,24 +12,24 @@ module Ci
           cluster.gcp_cluster_size,
           machine_type: cluster.gcp_machine_type)
       rescue Google::Apis::ServerError, Google::Apis::ClientError, Google::Apis::AuthorizationError => e
-        return cluster.errored!("Failed to request to CloudPlatform; #{e.message}")
+        return cluster.make_errored!("Failed to request to CloudPlatform; #{e.message}")
       end
 
       unless operation.status == 'RUNNING' || operation.status == 'PENDING'
-        return cluster.errored!("Operation status is unexpected; #{operation.status_message}")
+        return cluster.make_errored!("Operation status is unexpected; #{operation.status_message}")
       end
 
       cluster.gcp_operation_id = api_client.parse_operation_id(operation.self_link)
 
       unless cluster.gcp_operation_id
-        return cluster.errored!('Can not find operation_id from self_link')
+        return cluster.make_errored!('Can not find operation_id from self_link')
       end
 
-      if cluster.creating
+      if cluster.make_creating
         WaitForClusterCreationWorker.perform_in(
           WaitForClusterCreationWorker::INITIAL_INTERVAL, cluster.id)
       else
-        return cluster.errored!("Failed to update cluster record; #{cluster.errors}")
+        return cluster.make_errored!("Failed to update cluster record; #{cluster.errors}")
       end
     end
   end
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index aa1cd84fa8c..f72bf409b20 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -12,14 +12,14 @@ class WaitForClusterCreationWorker
         case operation.status
         when 'RUNNING'
           if TIMEOUT < Time.zone.now - operation.start_time.to_time
-            return cluster.errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
+            return cluster.make_errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
           end
 
           WaitForClusterCreationWorker.perform_in(EAGER_INTERVAL, cluster.id)
         when 'DONE'
           Ci::FinalizeClusterCreationService.new.execute(cluster)
         else
-          return cluster.errored!("Unexpected operation status; #{operation.status} #{operation.status_message}")
+          return cluster.make_errored!("Unexpected operation status; #{operation.status} #{operation.status_message}")
         end
       end
     end
-- 
cgit v1.2.1


From a644f4b829080d603405c6eee73a88e2be5cf929 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 22:40:12 +0900
Subject: Add spec/models/gcp/cluster_spec.rb

---
 app/models/gcp/cluster.rb                          |   2 +-
 spec/factories/gcp/cluster.rb                      |  23 ++
 spec/models/gcp/cluster_spec.rb                    | 266 +++++++++++++++++++++
 spec/services/ci/create_cluster_service_spec.rb    |  19 ++
 .../ci/fetch_gcp_operation_service_spec.rb         |  17 ++
 .../ci/fetch_kubernetes_token_service_spec.rb      |  17 ++
 .../ci/finalize_cluster_creation_service_spec.rb   |  17 ++
 spec/services/ci/integrate_cluster_service_spec.rb |  17 ++
 spec/services/ci/provision_cluster_service_spec.rb |  17 ++
 spec/services/ci/update_cluster_service_spec.rb    |  17 ++
 10 files changed, 411 insertions(+), 1 deletion(-)
 create mode 100644 spec/factories/gcp/cluster.rb
 create mode 100644 spec/models/gcp/cluster_spec.rb
 create mode 100644 spec/services/ci/create_cluster_service_spec.rb
 create mode 100644 spec/services/ci/fetch_gcp_operation_service_spec.rb
 create mode 100644 spec/services/ci/fetch_kubernetes_token_service_spec.rb
 create mode 100644 spec/services/ci/finalize_cluster_creation_service_spec.rb
 create mode 100644 spec/services/ci/integrate_cluster_service_spec.rb
 create mode 100644 spec/services/ci/provision_cluster_service_spec.rb
 create mode 100644 spec/services/ci/update_cluster_service_spec.rb

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 21eab9d8c1c..367e9be578c 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -84,7 +84,7 @@ module Gcp
         cluster.gcp_operation_id = nil
       end
 
-      before_transition any => [:errored] do |cluster|
+      before_transition any => [:errored] do |cluster, transition|
         status_reason = transition.args.first
         cluster.status_reason = status_reason
       end
diff --git a/spec/factories/gcp/cluster.rb b/spec/factories/gcp/cluster.rb
new file mode 100644
index 00000000000..ea42c716649
--- /dev/null
+++ b/spec/factories/gcp/cluster.rb
@@ -0,0 +1,23 @@
+FactoryGirl.define do
+  factory :gcp_cluster, class: Gcp::Cluster do
+    project
+    user
+    enabled true
+    gcp_project_id 'gcp-project-12345'
+    gcp_cluster_name 'test-cluster'
+    gcp_cluster_zone 'us-central1-a'
+    gcp_cluster_size 1
+
+    trait :with_kubernetes_service do
+      service :kubernetes_service
+    end
+
+    trait :created_on_gke do
+      endpoint '111.111.111.111'
+      ca_cert 'xxxxxx'
+      kubernetes_token 'xxxxxx'
+      username 'xxxxxx'
+      password 'xxxxxx'
+    end
+  end
+end
diff --git a/spec/models/gcp/cluster_spec.rb b/spec/models/gcp/cluster_spec.rb
new file mode 100644
index 00000000000..5e4c35e24ff
--- /dev/null
+++ b/spec/models/gcp/cluster_spec.rb
@@ -0,0 +1,266 @@
+require 'spec_helper'
+
+describe Gcp::Cluster do
+  it { is_expected.to belong_to(:project) }
+  it { is_expected.to belong_to(:user) }
+  it { is_expected.to belong_to(:service) }
+
+  it { is_expected.to validate_presence_of(:gcp_cluster_zone) }
+
+  describe '#default_value_for' do
+    let(:cluster) { described_class.new }
+
+    it { expect(cluster.gcp_cluster_zone).to eq('us-central1-a') }
+    it { expect(cluster.gcp_cluster_size).to eq(3) }
+    it { expect(cluster.gcp_machine_type).to eq('n1-standard-4') }
+  end
+
+  describe '#validates' do
+    subject { cluster.valid? }
+
+    context 'when validates gcp_project_id' do
+      let(:cluster) { build(:gcp_cluster, gcp_project_id: gcp_project_id) }
+
+      context 'when valid' do
+        let(:gcp_project_id) { 'gcp-project-12345' }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when empty' do
+        let(:gcp_project_id) { '' }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when too long' do
+        let(:gcp_project_id) { 'A'*64 }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when includes abnormal character' do
+        let(:gcp_project_id) { '!!!!!!' }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'when validates gcp_cluster_name' do
+      let(:cluster) { build(:gcp_cluster, gcp_cluster_name: gcp_cluster_name) }
+
+      context 'when valid' do
+        let(:gcp_cluster_name) { 'test-cluster' }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when empty' do
+        let(:gcp_cluster_name) { '' }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when too long' do
+        let(:gcp_cluster_name) { 'A'*64 }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when includes abnormal character' do
+        let(:gcp_cluster_name) { '!!!!!!' }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'when validates gcp_cluster_size' do
+      let(:cluster) { build(:gcp_cluster, gcp_cluster_size: gcp_cluster_size) }
+
+      context 'when valid' do
+        let(:gcp_cluster_size) { 1 }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when zero' do
+        let(:gcp_cluster_size) { 0 }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'when validates project_namespace' do
+      let(:cluster) { build(:gcp_cluster, project_namespace: project_namespace) }
+
+      context 'when valid' do
+        let(:project_namespace) { 'default-namespace' }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when empty' do
+        let(:project_namespace) { '' }
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when too long' do
+        let(:project_namespace) { 'A'*64 }
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when includes abnormal character' do
+        let(:project_namespace) { '!!!!!!' }
+
+        it { is_expected.to be_falsey }
+      end
+    end
+
+    context 'when validates restrict_modification' do
+      let(:cluster) { create(:gcp_cluster) }
+
+      before do
+        cluster.creating!
+      end
+
+      context 'when created' do
+        before do
+          cluster.created!
+        end
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when creating' do
+        it { is_expected.to be_falsey }
+      end
+    end
+  end
+
+  describe '#state_machine' do
+    let(:cluster) { build(:gcp_cluster) }
+
+    context 'when transits to created state' do
+      before do
+        cluster.gcp_token = 'tmp'
+        cluster.gcp_operation_id = 'tmp'
+        cluster.make_created!
+      end
+
+      it 'nullify gcp_token and gcp_operation_id' do
+        expect(cluster.gcp_token).to be_nil
+        expect(cluster.gcp_operation_id).to be_nil
+        expect(cluster).to be_created
+      end
+    end
+
+    context 'when transits to errored state' do
+      let(:reason) { 'something wrong' }
+
+      before do
+        cluster.make_errored!(reason)
+      end
+
+      it 'sets status_reason' do
+        expect(cluster.status_reason).to eq(reason)
+        expect(cluster).to be_errored
+      end
+    end
+  end
+
+  describe '#project_namespace_placeholder' do
+    subject { cluster.project_namespace_placeholder }
+
+    let(:cluster) { create(:gcp_cluster) }
+
+    it 'returns a placeholder' do
+      is_expected.to eq("#{cluster.project.path}-#{cluster.project.id}")
+    end
+  end
+
+  describe '#on_creation?' do
+    subject { cluster.on_creation? }
+
+    let(:cluster) { create(:gcp_cluster) }
+
+    context 'when status is creating' do
+      before do
+        cluster.make_creating!
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when status is created' do
+      before do
+        cluster.make_created!
+      end
+
+      it { is_expected.to be_falsey }
+    end
+  end
+
+  describe '#api_url' do
+    subject { cluster.api_url }
+
+    let(:cluster) { create(:gcp_cluster, :created_on_gke) }
+    let(:api_url) { 'https://' + cluster.endpoint }
+
+    it { is_expected.to eq(api_url) }
+  end
+
+  describe '#restrict_modification' do
+    subject { cluster.restrict_modification }
+
+    let(:cluster) { create(:gcp_cluster) }
+
+    context 'when status is created' do
+      before do
+        cluster.make_created!
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when status is creating' do
+      before do
+        cluster.make_creating!
+      end
+
+      it { is_expected.to be_falsey }
+
+      it 'sets error' do
+        is_expected.to be_falsey
+        expect(cluster.errors).not_to be_empty
+      end
+    end
+  end
+
+  describe '#destroy' do
+    subject { cluster.destroy }
+
+    let(:cluster) { create(:gcp_cluster) }
+
+    context 'when status is created' do
+      before do
+        cluster.make_created!
+      end
+
+      it 'destory the cluster' do
+        is_expected.to eq(cluster)
+      end
+    end
+
+    context 'when status is creating' do
+      before do
+        cluster.make_creating!
+      end
+
+      it 'does not destory the cluster' do
+        is_expected.to be_nil
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/create_cluster_service_spec.rb b/spec/services/ci/create_cluster_service_spec.rb
new file mode 100644
index 00000000000..eaa27eb4cc3
--- /dev/null
+++ b/spec/services/ci/create_cluster_service_spec.rb
@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe Ci::CreateClusterService do
+  describe '#execute' do
+    let(:access_token) { 'xxx' }
+
+    context 'when correct params' do
+      it 'creates a cluster object' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns an error' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/fetch_gcp_operation_service_spec.rb b/spec/services/ci/fetch_gcp_operation_service_spec.rb
new file mode 100644
index 00000000000..13141d81ab8
--- /dev/null
+++ b/spec/services/ci/fetch_gcp_operation_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::FetchGcpOperationService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'fetch the gcp operaion' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'sets an error to cluster object' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/fetch_kubernetes_token_service_spec.rb b/spec/services/ci/fetch_kubernetes_token_service_spec.rb
new file mode 100644
index 00000000000..b66b5a7947d
--- /dev/null
+++ b/spec/services/ci/fetch_kubernetes_token_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::FetchKubernetesTokenService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'fetch the kubernetes token' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns nil' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/finalize_cluster_creation_service_spec.rb b/spec/services/ci/finalize_cluster_creation_service_spec.rb
new file mode 100644
index 00000000000..81af15942c0
--- /dev/null
+++ b/spec/services/ci/finalize_cluster_creation_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::FinalizeClusterCreationService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'execute IntegrateClusterService' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns a cluster object with error' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/integrate_cluster_service_spec.rb b/spec/services/ci/integrate_cluster_service_spec.rb
new file mode 100644
index 00000000000..7a8c80ca4e7
--- /dev/null
+++ b/spec/services/ci/integrate_cluster_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::IntegrateClusterService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'creates a cluster object' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns a cluster object with error' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/provision_cluster_service_spec.rb b/spec/services/ci/provision_cluster_service_spec.rb
new file mode 100644
index 00000000000..d1595c8917d
--- /dev/null
+++ b/spec/services/ci/provision_cluster_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::ProvisionClusterService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'creates a cluster on gke' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns a cluster object with error' do
+
+      end
+    end
+  end
+end
diff --git a/spec/services/ci/update_cluster_service_spec.rb b/spec/services/ci/update_cluster_service_spec.rb
new file mode 100644
index 00000000000..afe3d418a8e
--- /dev/null
+++ b/spec/services/ci/update_cluster_service_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Ci::UpdateClusterService do
+  describe '#execute' do
+    context 'when correct params' do
+      it 'updates the cluster and the service' do
+        
+      end
+    end
+
+    context 'when invalid params' do
+      it 'returns a cluster object with error' do
+
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 8d9d0f9401269a5718da9d22a1863a4c4ab5f36e Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Wed, 4 Oct 2017 23:26:56 +0900
Subject: create_cluster_service_spec. cluster_provision_worker_spec.
 cluster_queue_spec.

---
 spec/services/ci/create_cluster_service_spec.rb    | 32 ++++++++++++++++++++--
 spec/workers/cluster_provision_worker_spec.rb      | 23 ++++++++++++++++
 spec/workers/concerns/cluster_queue_spec.rb        | 15 ++++++++++
 .../wait_for_cluster_creation_worker_spec.rb       | 25 +++++++++++++++++
 4 files changed, 93 insertions(+), 2 deletions(-)
 create mode 100644 spec/workers/cluster_provision_worker_spec.rb
 create mode 100644 spec/workers/concerns/cluster_queue_spec.rb
 create mode 100644 spec/workers/wait_for_cluster_creation_worker_spec.rb

diff --git a/spec/services/ci/create_cluster_service_spec.rb b/spec/services/ci/create_cluster_service_spec.rb
index eaa27eb4cc3..a905ca9895f 100644
--- a/spec/services/ci/create_cluster_service_spec.rb
+++ b/spec/services/ci/create_cluster_service_spec.rb
@@ -3,16 +3,44 @@ require 'spec_helper'
 describe Ci::CreateClusterService do
   describe '#execute' do
     let(:access_token) { 'xxx' }
+    let(:project) { create(:project) }
+    let(:user) { create(:user) }
+    let(:result) { described_class.new(project, user, params).execute(access_token) }
 
     context 'when correct params' do
+      let(:params) do
+        {
+          gcp_project_id: 'gcp-project',
+          gcp_cluster_name: 'test-cluster',
+          gcp_cluster_zone: 'us-central1-a',
+          gcp_cluster_size: 1,
+        }
+      end
+
       it 'creates a cluster object' do
-        
+        expect(ClusterProvisionWorker).to receive(:perform_async)
+        expect { result }.to change { Gcp::Cluster.count }.by(1)
+        expect(result.gcp_project_id).to eq('gcp-project')
+        expect(result.gcp_cluster_name).to eq('test-cluster')
+        expect(result.gcp_cluster_zone).to eq('us-central1-a')
+        expect(result.gcp_cluster_size).to eq(1)
+        expect(result.gcp_token).to eq(access_token)
       end
     end
 
     context 'when invalid params' do
-      it 'returns an error' do
+      let(:params) do
+        {
+          gcp_project_id: 'gcp-project',
+          gcp_cluster_name: 'test-cluster',
+          gcp_cluster_zone: 'us-central1-a',
+          gcp_cluster_size: 'ABC',
+        }
+      end
 
+      it 'returns an error' do
+        expect(ClusterProvisionWorker).not_to receive(:perform_async)
+        expect { result }.to change { Gcp::Cluster.count }.by(0)
       end
     end
   end
diff --git a/spec/workers/cluster_provision_worker_spec.rb b/spec/workers/cluster_provision_worker_spec.rb
new file mode 100644
index 00000000000..11f208289db
--- /dev/null
+++ b/spec/workers/cluster_provision_worker_spec.rb
@@ -0,0 +1,23 @@
+require 'spec_helper'
+
+describe ClusterProvisionWorker do
+  describe '#perform' do
+    context 'when cluster exists' do
+      let(:cluster) { create(:gcp_cluster) }
+
+      it 'provision a cluster' do
+        expect_any_instance_of(Ci::ProvisionClusterService).to receive(:execute)
+
+        described_class.new.perform(cluster.id)
+      end
+    end
+
+    context 'when cluster does not exist' do
+      it 'does not provision a cluster' do
+        expect_any_instance_of(Ci::ProvisionClusterService).not_to receive(:execute)
+
+        described_class.new.perform(123)
+      end
+    end
+  end
+end
diff --git a/spec/workers/concerns/cluster_queue_spec.rb b/spec/workers/concerns/cluster_queue_spec.rb
new file mode 100644
index 00000000000..1050651fa51
--- /dev/null
+++ b/spec/workers/concerns/cluster_queue_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe ClusterQueue do
+  let(:worker) do
+    Class.new do
+      include Sidekiq::Worker
+      include ClusterQueue
+    end
+  end
+
+  it 'sets a default pipelines queue automatically' do
+    expect(worker.sidekiq_options['queue'])
+      .to eq :gcp_cluster
+  end
+end
diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
new file mode 100644
index 00000000000..753c7efb9af
--- /dev/null
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe WaitForClusterCreationWorker do
+  describe '#perform' do
+    context 'when cluster exists' do
+      let(:cluster) { create(:gcp_cluster) }
+
+      it 'fetches gcp operation status' do
+        expect_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute)
+
+        described_class.new.perform(cluster.id)
+      end
+
+      # TODO: context 'when operation.status is runnning'
+    end
+
+    context 'when cluster does not exist' do
+      it 'does not provision a cluster' do
+        expect_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute).with(nil)
+
+        described_class.new.perform(123)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From e58c8413d47080498f4327cbcb6e08edae44aa9e Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Tue, 26 Sep 2017 14:23:01 +0200
Subject: Fixed Back Button for files + line number jumping for preview and
 editor

---
 .../javascripts/repo/components/repo_editor.vue    |  2 +-
 .../javascripts/repo/components/repo_sidebar.vue   | 27 ++++++++++++++++++----
 app/assets/javascripts/repo/helpers/repo_helper.js |  4 +++-
 app/assets/javascripts/repo/stores/repo_store.js   |  4 ++++
 4 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/app/assets/javascripts/repo/components/repo_editor.vue b/app/assets/javascripts/repo/components/repo_editor.vue
index 96d6a75bb61..f1acd339ad3 100644
--- a/app/assets/javascripts/repo/components/repo_editor.vue
+++ b/app/assets/javascripts/repo/components/repo_editor.vue
@@ -63,7 +63,7 @@ const RepoEditor = {
       const lineNumber = e.target.position.lineNumber;
       if (e.target.element.classList.contains('line-numbers')) {
         location.hash = `L${lineNumber}`;
-        Store.activeLine = lineNumber;
+        Store.setActiveLine(lineNumber);
 
         Helper.monacoInstance.setPosition({
           lineNumber: this.activeLine,
diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 1e40814b95f..535206bafe3 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -25,11 +25,28 @@ export default {
 
   methods: {
     addPopEventListener() {
-      window.addEventListener('popstate', () => {
-        if (location.href.indexOf('#') > -1) return;
-        this.linkClicked({
-          url: location.href,
-        });
+      window.addEventListener('popstate', (event) => {
+        const selectedFile = this.files.find(file => location.href.indexOf(file.url) > -1);
+        if (selectedFile) {
+          if (selectedFile.url !== this.activeFile.url) {
+            this.fileClicked(selectedFile);
+          }
+
+          if (location.hash.indexOf('#L') > -1) {
+            const lineNumber = Number(location.hash.substr(2));
+            if (!isNaN(lineNumber)) {
+              Store.setActiveLine(lineNumber);
+              if (Store.isPreviewView()) {
+                document.getElementById('L' + lineNumber).scrollIntoView();
+              } else {
+                Helper.monacoInstance.setPosition({
+                  lineNumber: this.activeLine,
+                  column: 1,
+                });
+              }
+            }
+          }
+        }
       });
     },
 
diff --git a/app/assets/javascripts/repo/helpers/repo_helper.js b/app/assets/javascripts/repo/helpers/repo_helper.js
index ac59a2bed23..7483f8bc305 100644
--- a/app/assets/javascripts/repo/helpers/repo_helper.js
+++ b/app/assets/javascripts/repo/helpers/repo_helper.js
@@ -254,7 +254,9 @@ const RepoHelper = {
 
     RepoHelper.key = RepoHelper.genKey();
 
-    history.pushState({ key: RepoHelper.key }, '', url);
+    if (document.location.pathname !== url) {
+      history.pushState({ key: RepoHelper.key }, '', url);
+    }
 
     if (title) {
       document.title = title;
diff --git a/app/assets/javascripts/repo/stores/repo_store.js b/app/assets/javascripts/repo/stores/repo_store.js
index 9a4fc40bc69..0d1853ff148 100644
--- a/app/assets/javascripts/repo/stores/repo_store.js
+++ b/app/assets/javascripts/repo/stores/repo_store.js
@@ -101,6 +101,10 @@ const RepoStore = {
     RepoStore.activeFileIndex = i;
   },
 
+  setActiveLine(activeLine) {
+    RepoStore.activeLine = activeLine;
+  },
+
   setActiveToRaw() {
     RepoStore.activeFile.raw = false;
     // can't get vue to listen to raw for some reason so RepoStore for now.
-- 
cgit v1.2.1


From 9196a356ae675ab97e7ed49e48c1e59105ad2a81 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Tue, 26 Sep 2017 14:58:14 +0200
Subject: Polished Back Button for files that are not in the tree anymore

---
 app/assets/javascripts/repo/components/repo_sidebar.vue | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 535206bafe3..702056a7e3a 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -26,7 +26,11 @@ export default {
   methods: {
     addPopEventListener() {
       window.addEventListener('popstate', (event) => {
-        const selectedFile = this.files.find(file => location.href.indexOf(file.url) > -1);
+        let selectedFile = this.files.find(file => {return location.pathname.indexOf(file.url) > -1});
+        if (!selectedFile) {
+          // Maybe it is not in the current tree but in the opened tabs
+          selectedFile = Store.openedFiles.find(file => {return location.pathname.indexOf(file.url) > -1});
+        }
         if (selectedFile) {
           if (selectedFile.url !== this.activeFile.url) {
             this.fileClicked(selectedFile);
@@ -46,6 +50,11 @@ export default {
               }
             }
           }
+        } else {
+          // Not opened at all lets open new tab
+          this.fileClicked({
+            url: location.href,
+          });
         }
       });
     },
-- 
cgit v1.2.1


From 45b8266bcd97c1132a5012ca4df578df4999c6ac Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Fri, 29 Sep 2017 09:07:47 +0200
Subject: Fixed Eslint Errors

---
 app/assets/javascripts/repo/components/repo_sidebar.vue | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 702056a7e3a..f741a8d46bc 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -25,11 +25,11 @@ export default {
 
   methods: {
     addPopEventListener() {
-      window.addEventListener('popstate', (event) => {
-        let selectedFile = this.files.find(file => {return location.pathname.indexOf(file.url) > -1});
+      window.addEventListener('popstate', () => {
+        let selectedFile = this.files.find(file => location.pathname.indexOf(file.url) > -1);
         if (!selectedFile) {
           // Maybe it is not in the current tree but in the opened tabs
-          selectedFile = Store.openedFiles.find(file => {return location.pathname.indexOf(file.url) > -1});
+          selectedFile = Store.openedFiles.find(file => location.pathname.indexOf(file.url) > -1);
         }
         if (selectedFile) {
           if (selectedFile.url !== this.activeFile.url) {
@@ -41,7 +41,7 @@ export default {
             if (!isNaN(lineNumber)) {
               Store.setActiveLine(lineNumber);
               if (Store.isPreviewView()) {
-                document.getElementById('L' + lineNumber).scrollIntoView();
+                document.getElementById(`L${lineNumber}`).scrollIntoView();
               } else {
                 Helper.monacoInstance.setPosition({
                   lineNumber: this.activeLine,
-- 
cgit v1.2.1


From 1429e5b57df2107746d8550abebb423107b5399a Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Mon, 2 Oct 2017 15:02:52 +0200
Subject: Added Test for Back Button Behaviour

---
 .../repo/components/repo_sidebar_spec.js           | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/spec/javascripts/repo/components/repo_sidebar_spec.js b/spec/javascripts/repo/components/repo_sidebar_spec.js
index db9911c7a2c..9959d23a07d 100644
--- a/spec/javascripts/repo/components/repo_sidebar_spec.js
+++ b/spec/javascripts/repo/components/repo_sidebar_spec.js
@@ -121,5 +121,37 @@ describe('RepoSidebar', () => {
         expect(RepoService.url).toEqual(prevUrl);
       });
     });
+
+    describe('back button', () => {
+      const file1 = {
+        id: 1,
+        url: 'file1',
+      };
+      const file2 = {
+        id: 2,
+        url: 'file2',
+      };
+      RepoStore.files = [file1, file2];
+      RepoStore.openedFiles = [file1, file2];
+      RepoStore.isRoot = true;
+
+      const vm = createComponent();
+      vm.fileClicked(file1);
+
+      it('render previous file when using back button', () => {
+        spyOn(Helper, 'getContent').and.callThrough();
+        vm.fileClicked(file2);
+        expect(Helper.getContent).toHaveBeenCalledWith(file2);
+
+        history.pushState({
+          key: Math.random(),
+        }, '', file1.url);
+        const popEvent = document.createEvent('Event');
+        popEvent.initEvent('popstate', true, true);
+        window.dispatchEvent(popEvent);
+
+        expect(Helper.getContent).toHaveBeenCalledWith(file1);
+      });
+    });
   });
 });
-- 
cgit v1.2.1


From 25186c7aee7f0c25bd3c8fbaab353742d54afdf2 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Tue, 3 Oct 2017 11:01:36 +0200
Subject: Fixed Repo Sidebar Tests

---
 .../javascripts/repo/components/repo_sidebar.vue   | 59 +++++++++++-----------
 .../repo/components/repo_sidebar_spec.js           | 26 +++++++---
 2 files changed, 48 insertions(+), 37 deletions(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index f741a8d46bc..9d3e20a195b 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -18,45 +18,46 @@ export default {
   },
 
   created() {
-    this.addPopEventListener();
+    window.addEventListener('popstate', this.checkHistory);
+  },
+  destroyed() {
+    window.removeEventListener('popstate', this.checkHistory);
   },
 
   data: () => Store,
 
   methods: {
-    addPopEventListener() {
-      window.addEventListener('popstate', () => {
-        let selectedFile = this.files.find(file => location.pathname.indexOf(file.url) > -1);
-        if (!selectedFile) {
-          // Maybe it is not in the current tree but in the opened tabs
-          selectedFile = Store.openedFiles.find(file => location.pathname.indexOf(file.url) > -1);
+    checkHistory() {
+      let selectedFile = this.files.find(file => location.pathname.indexOf(file.url) > -1);
+      if (!selectedFile) {
+        // Maybe it is not in the current tree but in the opened tabs
+        selectedFile = Store.openedFiles.find(file => location.pathname.indexOf(file.url) > -1);
+      }
+      if (selectedFile) {
+        if (selectedFile.url !== this.activeFile.url) {
+          this.fileClicked(selectedFile);
         }
-        if (selectedFile) {
-          if (selectedFile.url !== this.activeFile.url) {
-            this.fileClicked(selectedFile);
-          }
 
-          if (location.hash.indexOf('#L') > -1) {
-            const lineNumber = Number(location.hash.substr(2));
-            if (!isNaN(lineNumber)) {
-              Store.setActiveLine(lineNumber);
-              if (Store.isPreviewView()) {
-                document.getElementById(`L${lineNumber}`).scrollIntoView();
-              } else {
-                Helper.monacoInstance.setPosition({
-                  lineNumber: this.activeLine,
-                  column: 1,
-                });
-              }
+        if (location.hash.indexOf('#L') > -1) {
+          const lineNumber = Number(location.hash.substr(2));
+          if (!isNaN(lineNumber)) {
+            Store.setActiveLine(lineNumber);
+            if (Store.isPreviewView()) {
+              document.getElementById(`L${lineNumber}`).scrollIntoView();
+            } else {
+              Helper.monacoInstance.setPosition({
+                lineNumber: this.activeLine,
+                column: 1,
+              });
             }
           }
-        } else {
-          // Not opened at all lets open new tab
-          this.fileClicked({
-            url: location.href,
-          });
         }
-      });
+      } else {
+        // Not opened at all lets open new tab
+        this.fileClicked({
+          url: location.href,
+        });
+      }
     },
 
     fileClicked(clickedFile) {
diff --git a/spec/javascripts/repo/components/repo_sidebar_spec.js b/spec/javascripts/repo/components/repo_sidebar_spec.js
index 9959d23a07d..07ad995479a 100644
--- a/spec/javascripts/repo/components/repo_sidebar_spec.js
+++ b/spec/javascripts/repo/components/repo_sidebar_spec.js
@@ -5,18 +5,26 @@ import RepoStore from '~/repo/stores/repo_store';
 import repoSidebar from '~/repo/components/repo_sidebar.vue';
 
 describe('RepoSidebar', () => {
+  let vm;
+
   function createComponent() {
     const RepoSidebar = Vue.extend(repoSidebar);
 
     return new RepoSidebar().$mount();
   }
 
+  afterEach(() => {
+    vm.$destroy();
+  });
+
   it('renders a sidebar', () => {
     RepoStore.files = [{
       id: 0,
     }];
     RepoStore.openedFiles = [];
-    const vm = createComponent();
+    RepoStore.isRoot = false;
+
+    vm = createComponent();
     const thead = vm.$el.querySelector('thead');
     const tbody = vm.$el.querySelector('tbody');
 
@@ -35,7 +43,7 @@ describe('RepoSidebar', () => {
     RepoStore.openedFiles = [{
       id: 0,
     }];
-    const vm = createComponent();
+    vm = createComponent();
 
     expect(vm.$el.classList.contains('sidebar-mini')).toBeTruthy();
     expect(vm.$el.querySelector('thead')).toBeFalsy();
@@ -47,7 +55,7 @@ describe('RepoSidebar', () => {
       tree: true,
     };
     RepoStore.files = [];
-    const vm = createComponent();
+    vm = createComponent();
 
     expect(vm.$el.querySelectorAll('tbody .loading-file').length).toEqual(5);
   });
@@ -57,7 +65,7 @@ describe('RepoSidebar', () => {
       id: 0,
     }];
     RepoStore.isRoot = true;
-    const vm = createComponent();
+    vm = createComponent();
 
     expect(vm.$el.querySelector('tbody .prev-directory')).toBeTruthy();
   });
@@ -103,7 +111,7 @@ describe('RepoSidebar', () => {
         };
         RepoStore.files = [file1];
         RepoStore.isRoot = true;
-        const vm = createComponent();
+        vm = createComponent();
 
         vm.fileClicked(file1);
 
@@ -114,7 +122,7 @@ describe('RepoSidebar', () => {
     describe('goToPreviousDirectoryClicked', () => {
       it('should hide files in directory if already open', () => {
         const prevUrl = 'foo/bar';
-        const vm = createComponent();
+        vm = createComponent();
 
         vm.goToPreviousDirectoryClicked(prevUrl);
 
@@ -135,13 +143,15 @@ describe('RepoSidebar', () => {
       RepoStore.openedFiles = [file1, file2];
       RepoStore.isRoot = true;
 
-      const vm = createComponent();
+      vm = createComponent();
       vm.fileClicked(file1);
 
       it('render previous file when using back button', () => {
         spyOn(Helper, 'getContent').and.callThrough();
+
         vm.fileClicked(file2);
         expect(Helper.getContent).toHaveBeenCalledWith(file2);
+        Helper.getContent.calls.reset();
 
         history.pushState({
           key: Math.random(),
@@ -150,7 +160,7 @@ describe('RepoSidebar', () => {
         popEvent.initEvent('popstate', true, true);
         window.dispatchEvent(popEvent);
 
-        expect(Helper.getContent).toHaveBeenCalledWith(file1);
+        expect(Helper.getContent.calls.mostRecent().args[0].url).toContain(file1.url);
       });
     });
   });
-- 
cgit v1.2.1


From a0d238066eb7d88a1ad136dab7c56fc63993b7d2 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Tue, 3 Oct 2017 11:32:47 +0200
Subject: Fixed RepoFile Test

---
 spec/javascripts/repo/components/repo_file_spec.js    | 16 +++++++++-------
 spec/javascripts/repo/components/repo_sidebar_spec.js |  4 ++--
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/spec/javascripts/repo/components/repo_file_spec.js b/spec/javascripts/repo/components/repo_file_spec.js
index f15633bd8b9..620b604f404 100644
--- a/spec/javascripts/repo/components/repo_file_spec.js
+++ b/spec/javascripts/repo/components/repo_file_spec.js
@@ -29,15 +29,17 @@ describe('RepoFile', () => {
     }).$mount();
   }
 
-  beforeEach(() => {
-    spyOn(repoFile.mixins[0].methods, 'timeFormated').and.returnValue(updated);
-  });
-
   it('renders link, icon, name and last commit details', () => {
-    const vm = createComponent({
-      file,
-      activeFile,
+    const RepoFile = Vue.extend(repoFile);
+    const vm = new RepoFile({
+      propsData: {
+        file,
+        activeFile,
+      },
     });
+    spyOn(vm, 'timeFormated').and.returnValue(updated);
+    vm.$mount();
+
     const name = vm.$el.querySelector('.repo-file-name');
     const fileIcon = vm.$el.querySelector('.file-icon');
 
diff --git a/spec/javascripts/repo/components/repo_sidebar_spec.js b/spec/javascripts/repo/components/repo_sidebar_spec.js
index 07ad995479a..5a81c6e611f 100644
--- a/spec/javascripts/repo/components/repo_sidebar_spec.js
+++ b/spec/javascripts/repo/components/repo_sidebar_spec.js
@@ -80,7 +80,7 @@ describe('RepoSidebar', () => {
         };
         RepoStore.files = [file1];
         RepoStore.isRoot = true;
-        const vm = createComponent();
+        vm = createComponent();
 
         vm.fileClicked(file1);
 
@@ -95,7 +95,7 @@ describe('RepoSidebar', () => {
 
         spyOn(Helper, 'getFileFromPath').and.returnValue(file);
         spyOn(RepoStore, 'setActiveFiles');
-        const vm = createComponent();
+        vm = createComponent();
         vm.fileClicked(file);
 
         expect(RepoStore.setActiveFiles).toHaveBeenCalledWith(file);
-- 
cgit v1.2.1


From 5c07687b3eedfc4200c9b3fcdffbc79026c285db Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Tue, 3 Oct 2017 13:56:01 +0200
Subject: Added Check for Line Number Element

---
 app/assets/javascripts/repo/components/repo_sidebar.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 9d3e20a195b..0e6acf96836 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -43,7 +43,7 @@ export default {
           if (!isNaN(lineNumber)) {
             Store.setActiveLine(lineNumber);
             if (Store.isPreviewView()) {
-              document.getElementById(`L${lineNumber}`).scrollIntoView();
+              if (document.getElementById(`L${lineNumber}`)) document.getElementById(`L${lineNumber}`).scrollIntoView();
             } else {
               Helper.monacoInstance.setPosition({
                 lineNumber: this.activeLine,
-- 
cgit v1.2.1


From 0a671c8223d7fab14acdb40d30a7a74696885d75 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Wed, 4 Oct 2017 11:20:06 +0200
Subject: Fixes the unhandled promise rejection

---
 spec/javascripts/repo/components/repo_sidebar_spec.js             | 2 ++
 spec/javascripts/vue_mr_widget/services/mr_widget_service_spec.js | 1 +
 2 files changed, 3 insertions(+)

diff --git a/spec/javascripts/repo/components/repo_sidebar_spec.js b/spec/javascripts/repo/components/repo_sidebar_spec.js
index 5a81c6e611f..bcc03ed743d 100644
--- a/spec/javascripts/repo/components/repo_sidebar_spec.js
+++ b/spec/javascripts/repo/components/repo_sidebar_spec.js
@@ -161,6 +161,8 @@ describe('RepoSidebar', () => {
         window.dispatchEvent(popEvent);
 
         expect(Helper.getContent.calls.mostRecent().args[0].url).toContain(file1.url);
+
+        window.history.pushState({}, null, '/');
       });
     });
   });
diff --git a/spec/javascripts/vue_mr_widget/services/mr_widget_service_spec.js b/spec/javascripts/vue_mr_widget/services/mr_widget_service_spec.js
index b63633c03b8..e667b4b3677 100644
--- a/spec/javascripts/vue_mr_widget/services/mr_widget_service_spec.js
+++ b/spec/javascripts/vue_mr_widget/services/mr_widget_service_spec.js
@@ -31,6 +31,7 @@ describe('MRWidgetService', () => {
   });
 
   it('should have methods defined', () => {
+    window.history.pushState({}, null, '/');
     const service = new MRWidgetService(mr);
 
     expect(service.merge()).toBeDefined();
-- 
cgit v1.2.1


From 8d14a95638d7d6b52254b192b3e54296e22fddc3 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Wed, 4 Oct 2017 17:22:07 +0200
Subject: Optimising If

---
 app/assets/javascripts/repo/components/repo_sidebar.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 0e6acf96836..9f58f63b850 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -42,8 +42,8 @@ export default {
           const lineNumber = Number(location.hash.substr(2));
           if (!isNaN(lineNumber)) {
             Store.setActiveLine(lineNumber);
-            if (Store.isPreviewView()) {
-              if (document.getElementById(`L${lineNumber}`)) document.getElementById(`L${lineNumber}`).scrollIntoView();
+            if (Store.isPreviewView() && document.getElementById(`L${lineNumber}`)) {
+              document.getElementById(`L${lineNumber}`).scrollIntoView();
             } else {
               Helper.monacoInstance.setPosition({
                 lineNumber: this.activeLine,
-- 
cgit v1.2.1


From 2e53056e94e2be32d481e084b68be87dc0e448dd Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Wed, 4 Oct 2017 16:43:45 +0100
Subject: Adds Frontend specs

---
 app/assets/javascripts/clusters.js         | 13 ++---
 app/views/projects/clusters/show.html.haml |  2 +-
 spec/javascripts/clusters_spec.js          | 79 ++++++++++++++++++++++++++++++
 spec/javascripts/fixtures/clusters.rb      | 35 +++++++++++++
 4 files changed, 118 insertions(+), 11 deletions(-)
 create mode 100644 spec/javascripts/clusters_spec.js
 create mode 100644 spec/javascripts/fixtures/clusters.rb

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index 5a381a5322a..8bd4de92e6f 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -11,7 +11,6 @@ import './flash';
  *
  * - Polling status while creating or scheduled
  * -- Update status area with the response result
- *
  */
 
 class ClusterService {
@@ -23,7 +22,7 @@ class ClusterService {
   }
 }
 
-export default class ClusterEdit {
+export default class Clusters {
   constructor() {
     const dataset = document.querySelector('.js-edit-cluster-form').dataset;
 
@@ -54,12 +53,7 @@ export default class ClusterEdit {
 
   toggle() {
     this.toggleButton.classList.toggle('checked');
-    this.state.toggleStatus = this.toggleButton.classList.contains('checked').toString();
-    this.toggleInput.setAttribute('value', this.state.toggleStatus);
-  }
-
-  updateData() {
-    this.service.updateData(this.state.toggleStatus);
+    this.toggleInput.setAttribute('value', this.toggleButton.classList.contains('checked').toString());
   }
 
   initPoling() {
@@ -104,7 +98,7 @@ export default class ClusterEdit {
         break;
       case 'errored':
         this.errorContainer.classList.remove('hidden');
-        this.errorContainer.querySelector('.js-error-reason').textContent = error.status_reason;
+        this.errorContainer.querySelector('.js-error-reason').textContent = error;
         break;
       case 'scheduled':
       case 'creating':
@@ -114,5 +108,4 @@ export default class ClusterEdit {
         this.hideAll();
     }
   }
-
 }
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index 9746df76365..f160ce98b55 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -41,7 +41,7 @@
 
       .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
         = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
-        %code.js-error-reason
+        %p.js-error-reason
 
       .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
         = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
diff --git a/spec/javascripts/clusters_spec.js b/spec/javascripts/clusters_spec.js
new file mode 100644
index 00000000000..2ceb0cfdf4c
--- /dev/null
+++ b/spec/javascripts/clusters_spec.js
@@ -0,0 +1,79 @@
+import Clusters from '~/clusters';
+
+describe('Clusters', () => {
+  let cluster;
+  preloadFixtures('clusters/show_cluster.html.raw');
+
+  beforeEach(() => {
+    loadFixtures('clusters/show_cluster.html.raw');
+    cluster = new Clusters();
+  });
+
+  describe('toggle', () => {
+    it('should update the button and the input field on click', () => {
+      cluster.toggleButton.click();
+
+      expect(
+        cluster.toggleButton.classList,
+      ).not.toContain('checked');
+
+      expect(
+        cluster.toggleInput.getAttribute('value'),
+      ).toEqual('false');
+    });
+  });
+
+  describe('updateContainer', () => {
+    describe('when creating cluster', () => {
+      it('should show the creating container', () => {
+        cluster.updateContainer('creating');
+
+        expect(
+          cluster.creatingContainer.classList,
+        ).not.toContain('hidden');
+        expect(
+          cluster.successContainer.classList,
+        ).toContain('hidden');
+        expect(
+          cluster.errorContainer.classList,
+        ).toContain('hidden');
+      });
+    });
+
+    describe('when cluster is created', () => {
+      it('should show the success container', () => {
+        cluster.updateContainer('created');
+
+        expect(
+          cluster.creatingContainer.classList,
+        ).toContain('hidden');
+        expect(
+          cluster.successContainer.classList,
+        ).not.toContain('hidden');
+        expect(
+          cluster.errorContainer.classList,
+        ).toContain('hidden');
+      });
+    });
+
+    describe('when cluster has error', () => {
+      it('should show the error container', () => {
+        cluster.updateContainer('errored', 'this is an error');
+
+        expect(
+          cluster.creatingContainer.classList,
+        ).toContain('hidden');
+        expect(
+          cluster.successContainer.classList,
+        ).toContain('hidden');
+        expect(
+          cluster.errorContainer.classList,
+        ).not.toContain('hidden');
+
+        expect(
+          cluster.errorContainer.querySelector('.js-error-reason').textContent,
+        ).toContain('this is an error');
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/fixtures/clusters.rb b/spec/javascripts/fixtures/clusters.rb
new file mode 100644
index 00000000000..be9d1d8f216
--- /dev/null
+++ b/spec/javascripts/fixtures/clusters.rb
@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe Projects::ClustersController, '(JavaScript fixtures)', type: :controller do
+  include JavaScriptFixturesHelpers
+
+  let(:admin) { create(:admin) }
+  let(:namespace) { create(:namespace, name: 'frontend-fixtures' )}
+  let(:project) { create(:project, :repository, namespace: namespace) }
+  let(:cluster) { project.create_cluster!(gcp_cluster_name: "gke-test-creation-1", gcp_project_id: 'gitlab-internal-153318', gcp_cluster_zone: 'us-central1-a', gcp_cluster_size: '1', project_namespace: 'aaa', gcp_machine_type: 'n1-standard-1')}
+
+  render_views
+
+  before(:all) do
+    clean_frontend_fixtures('branches/')
+  end
+
+  before do
+    sign_in(admin)
+  end
+
+  after do
+    remove_repository(project)
+  end
+
+  it 'clusters/show_cluster.html.raw' do |example|
+    get :show,
+      namespace_id: project.namespace.to_param,
+      project_id: project,
+      id: cluster
+
+    expect(response).to be_success
+    store_frontend_fixture(response, example.description)
+  end
+
+end
-- 
cgit v1.2.1


From bcd7686a194cfec013c394b7b49b4311299f2aa4 Mon Sep 17 00:00:00 2001
From: Takuya Noguchi <takninnovationresearch@gmail.com>
Date: Thu, 5 Oct 2017 01:32:03 +0900
Subject: Make tabs on top scrollable on admin dashboard

---
 app/views/admin/jobs/index.html.haml                     | 2 +-
 app/views/admin/projects/index.html.haml                 | 2 +-
 changelogs/unreleased/38775-scrollable-tabs-on-admin.yml | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/38775-scrollable-tabs-on-admin.yml

diff --git a/app/views/admin/jobs/index.html.haml b/app/views/admin/jobs/index.html.haml
index 0310498ae54..7066ed12b95 100644
--- a/app/views/admin/jobs/index.html.haml
+++ b/app/views/admin/jobs/index.html.haml
@@ -3,7 +3,7 @@
 
 %div{ class: container_class }
 
-  .top-area
+  .top-area.scrolling-tabs-container.inner-page-scroll-tabs
     - build_path_proc = ->(scope) { admin_jobs_path(scope: scope) }
     = render "shared/builds/tabs", build_path_proc: build_path_proc, all_builds: @all_builds, scope: @scope
 
diff --git a/app/views/admin/projects/index.html.haml b/app/views/admin/projects/index.html.haml
index 3f202fbf4fe..4d8754afdd2 100644
--- a/app/views/admin/projects/index.html.haml
+++ b/app/views/admin/projects/index.html.haml
@@ -4,7 +4,7 @@
 
 
 %div{ class: container_class }
-  .top-area
+  .top-area.scrolling-tabs-container.inner-page-scroll-tabs
     .prepend-top-default
       .search-holder
         = render 'shared/projects/search_form', autofocus: true, icon: true
diff --git a/changelogs/unreleased/38775-scrollable-tabs-on-admin.yml b/changelogs/unreleased/38775-scrollable-tabs-on-admin.yml
new file mode 100644
index 00000000000..65a66714bcb
--- /dev/null
+++ b/changelogs/unreleased/38775-scrollable-tabs-on-admin.yml
@@ -0,0 +1,5 @@
+---
+title: Make tabs on top scrollable on admin dashboard
+merge_request: 14685
+author: Takuya Noguchi
+type: fixed
-- 
cgit v1.2.1


From ed7213e0ec718bd8fde211a098dc4d1b75e7c799 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 4 Oct 2017 18:55:03 +0200
Subject: Do not retry jobs that are allowed to fail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `ee_compat_check` job can take 10 minutes to run so it's a shame to
retry it and loose 10 minutes if it fails for a good reason.

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 .gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8501911fde4..c80189a9399 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -270,6 +270,7 @@ flaky-examples-check:
     NEW_FLAKY_SPECS_REPORT: rspec_flaky/${CI_PROJECT_NAME}/new_rspec_flaky_examples.json
   stage: post-test
   allow_failure: yes
+  retry: 0
   only:
     - branches
   except:
@@ -429,6 +430,7 @@ ee_compat_check:
     - branches@gitlab-org/gitlab-ee
     - branches@gitlab/gitlab-ee
   allow_failure: yes
+  retry: 0
   cache:
     key: "ee_compat_check_repo"
     paths:
-- 
cgit v1.2.1


From e710e766b042ad0c74536416044ad0af2fdca012 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 01:55:33 +0900
Subject: fetch_gcp_operation_service_spec.
 finalize_cluster_creation_service_spec.
 wait_for_cluster_creation_worker_spec.

---
 .../ci/fetch_gcp_operation_service_spec.rb         | 27 +++++++++--
 .../ci/finalize_cluster_creation_service_spec.rb   | 54 ++++++++++++++++++++--
 .../wait_for_cluster_creation_worker_spec.rb       | 48 +++++++++++++++++--
 3 files changed, 116 insertions(+), 13 deletions(-)

diff --git a/spec/services/ci/fetch_gcp_operation_service_spec.rb b/spec/services/ci/fetch_gcp_operation_service_spec.rb
index 13141d81ab8..7792979c5cb 100644
--- a/spec/services/ci/fetch_gcp_operation_service_spec.rb
+++ b/spec/services/ci/fetch_gcp_operation_service_spec.rb
@@ -1,16 +1,35 @@
 require 'spec_helper'
+require 'google/apis'
 
 describe Ci::FetchGcpOperationService do
   describe '#execute' do
-    context 'when correct params' do
+    let(:cluster) { create(:gcp_cluster) }
+    let(:operation) { double }
+
+    context 'when suceeded' do
+      before do
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_operations).and_return(operation)
+      end
+
       it 'fetch the gcp operaion' do
-        
+        expect { |b| described_class.new.execute(cluster, &b) }
+          .to yield_with_args(operation)
       end
     end
 
-    context 'when invalid params' do
-      it 'sets an error to cluster object' do
+    context 'when raises an error' do
+      let(:error) { Google::Apis::ServerError.new('a') }
 
+      before do
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_operations).and_raise(error)
+      end
+
+      it 'sets an error to cluster object' do
+        expect { |b| described_class.new.execute(cluster, &b) }
+          .not_to yield_with_args
+        expect(cluster.reload).to be_errored
       end
     end
   end
diff --git a/spec/services/ci/finalize_cluster_creation_service_spec.rb b/spec/services/ci/finalize_cluster_creation_service_spec.rb
index 81af15942c0..def3709fdb4 100644
--- a/spec/services/ci/finalize_cluster_creation_service_spec.rb
+++ b/spec/services/ci/finalize_cluster_creation_service_spec.rb
@@ -2,15 +2,59 @@ require 'spec_helper'
 
 describe Ci::FinalizeClusterCreationService do
   describe '#execute' do
-    context 'when correct params' do
-      it 'execute IntegrateClusterService' do
-        
+    let(:cluster) { create(:gcp_cluster) }
+    let(:result) { described_class.new.execute(cluster) }
+
+    context 'when suceeded to get cluster from api' do
+      let(:gke_cluster) { double }
+
+      before do
+        allow(gke_cluster).to receive(:endpoint).and_return('111.111.111.111')
+        allow(gke_cluster).to receive(:master_auth).and_return(spy)
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_clusters_get).and_return(gke_cluster)
+      end
+
+      context 'when suceeded to get kubernetes token' do
+        let(:kubernetes_token) { 'abc' }
+
+        before do
+          allow_any_instance_of(Ci::FetchKubernetesTokenService)
+            .to receive(:execute).and_return(kubernetes_token)
+        end
+
+        it 'executes integration cluster' do
+          expect_any_instance_of(Ci::IntegrateClusterService).to receive(:execute)
+          described_class.new.execute(cluster)
+        end
+      end
+
+      context 'when failed to get kubernetes token' do
+        before do
+          allow_any_instance_of(Ci::FetchKubernetesTokenService)
+            .to receive(:execute).and_return(nil)
+        end
+
+        it 'sets an error to cluster object' do
+          described_class.new.execute(cluster)
+
+          expect(cluster.reload).to be_errored
+        end
       end
     end
 
-    context 'when invalid params' do
-      it 'returns a cluster object with error' do
+    context 'when failed to get cluster from api' do
+      let(:error) { Google::Apis::ServerError.new('a') }
+
+      before do
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_clusters_get).and_raise(error)
+      end
+
+      it 'sets an error to cluster object' do
+        described_class.new.execute(cluster)
 
+        expect(cluster.reload).to be_errored
       end
     end
   end
diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
index 753c7efb9af..eed6bec00f8 100644
--- a/spec/workers/wait_for_cluster_creation_worker_spec.rb
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -4,14 +4,54 @@ describe WaitForClusterCreationWorker do
   describe '#perform' do
     context 'when cluster exists' do
       let(:cluster) { create(:gcp_cluster) }
+      let(:operation) { double }
 
-      it 'fetches gcp operation status' do
-        expect_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute)
+      before do
+        allow(operation).to receive(:status).and_return(status)
+        allow(operation).to receive(:start_time).and_return(1.minutes.ago)
+        allow(operation).to receive(:status_message).and_return('error')
+        allow_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute).and_yield(operation)
+      end
+
+      context 'when operation status is RUNNING' do
+        let(:status) { 'RUNNING' }
+
+        it 'reschedules worker' do
+          expect(WaitForClusterCreationWorker).to receive(:perform_in)
 
-        described_class.new.perform(cluster.id)
+          described_class.new.perform(cluster.id)
+        end
+
+        context 'when operation timeout' do
+          before do
+            allow(operation).to receive(:start_time).and_return(30.minutes.ago)
+          end
+
+          it 'sets an error message on cluster' do
+            described_class.new.perform(cluster.id)
+            expect(cluster.reload).to be_errored
+          end
+        end
       end
 
-      # TODO: context 'when operation.status is runnning'
+      context 'when operation status is DONE' do
+        let(:status) { 'DONE' }
+
+        it 'finalizes cluster creation' do
+          expect_any_instance_of(Ci::FinalizeClusterCreationService).to receive(:execute)
+
+          described_class.new.perform(cluster.id)
+        end
+      end
+
+      context 'when operation status is others' do
+        let(:status) { 'others' }
+
+        it 'sets an error message on cluster' do
+          described_class.new.perform(cluster.id)
+          expect(cluster.reload).to be_errored
+        end
+      end
     end
 
     context 'when cluster does not exist' do
-- 
cgit v1.2.1


From f16ac0efda68cfb6819e784dbec5609b10e8de7d Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 21:09:40 +0200
Subject: Added usage ping

---
 lib/gitlab/usage_data.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/gitlab/usage_data.rb b/lib/gitlab/usage_data.rb
index 6857038dba8..3f3ba77d47f 100644
--- a/lib/gitlab/usage_data.rb
+++ b/lib/gitlab/usage_data.rb
@@ -48,6 +48,7 @@ module Gitlab
             deploy_keys: DeployKey.count,
             deployments: Deployment.count,
             environments: ::Environment.count,
+            gcp_clusters: ::Gcp::Cluster.count,
             in_review_folder: ::Environment.in_review_folder.count,
             groups: Group.count,
             issues: Issue.count,
-- 
cgit v1.2.1


From 54831bd44bdf7f7b19ac3a129ebf6384549d9c63 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 21:10:08 +0200
Subject: Updated messages and notices

---
 app/controllers/projects/clusters_controller.rb |  6 +++---
 app/models/gcp/cluster.rb                       |  4 ----
 spec/models/gcp/cluster_spec.rb                 | 26 -------------------------
 spec/models/project_spec.rb                     |  1 +
 4 files changed, 4 insertions(+), 33 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 46118184993..051d3c00837 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -61,7 +61,7 @@ class Projects::ClustersController < Projects::ApplicationController
       .execute(cluster)
 
       if cluster.valid?
-        flash[:notice] = "Cluster updated"
+        flash[:notice] = "Cluster was successfully updated."
         redirect_to project_cluster_path(project, project.cluster)
       else
         render :show
@@ -70,10 +70,10 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def destroy
     if cluster.destroy
-      flash[:notice] = "Cluster removed"
+      flash[:notice] = "Cluster was successfully removed."
       redirect_to project_clusters_path(project), status: 302
     else
-      flash[:notice] = "Cluster removed"
+      flash[:notice] = "Cluster was not removed."
       render :show
     end
   end
diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 367e9be578c..f570c8b3c4c 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -110,9 +110,5 @@ module Gcp
 
       true
     end
-
-    def destroy
-      super if restrict_modification
-    end
   end
 end
diff --git a/spec/models/gcp/cluster_spec.rb b/spec/models/gcp/cluster_spec.rb
index 5e4c35e24ff..cf3036cefce 100644
--- a/spec/models/gcp/cluster_spec.rb
+++ b/spec/models/gcp/cluster_spec.rb
@@ -237,30 +237,4 @@ describe Gcp::Cluster do
       end
     end
   end
-
-  describe '#destroy' do
-    subject { cluster.destroy }
-
-    let(:cluster) { create(:gcp_cluster) }
-
-    context 'when status is created' do
-      before do
-        cluster.make_created!
-      end
-
-      it 'destory the cluster' do
-        is_expected.to eq(cluster)
-      end
-    end
-
-    context 'when status is creating' do
-      before do
-        cluster.make_creating!
-      end
-
-      it 'does not destory the cluster' do
-        is_expected.to be_nil
-      end
-    end
-  end
 end
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 176bb568cbe..e62bfaf22ba 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -76,6 +76,7 @@ describe Project do
     it { is_expected.to have_many(:uploads).dependent(:destroy) }
     it { is_expected.to have_many(:pipeline_schedules) }
     it { is_expected.to have_many(:members_and_requesters) }
+    it { is_expected.to have_one(:cluster) }
 
     context 'after initialized' do
       it "has a project_feature" do
-- 
cgit v1.2.1


From bee5c08094b4f2c125509f61e9e03a7a700bba5e Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 21:13:01 +0200
Subject: Fix Rubocop failures

---
 app/controllers/projects/clusters_controller.rb       | 12 ++++++------
 spec/javascripts/fixtures/clusters.rb                 |  1 -
 spec/models/gcp/cluster_spec.rb                       |  6 +++---
 spec/services/ci/create_cluster_service_spec.rb       |  4 ++--
 spec/workers/wait_for_cluster_creation_worker_spec.rb |  4 ++--
 5 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 051d3c00837..5ee30deee9d 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -60,12 +60,12 @@ class Projects::ClustersController < Projects::ApplicationController
       .new(project, current_user, cluster_params)
       .execute(cluster)
 
-      if cluster.valid?
-        flash[:notice] = "Cluster was successfully updated."
-        redirect_to project_cluster_path(project, project.cluster)
-      else
-        render :show
-      end
+    if cluster.valid?
+      flash[:notice] = "Cluster was successfully updated."
+      redirect_to project_cluster_path(project, project.cluster)
+    else
+      render :show
+    end
   end
 
   def destroy
diff --git a/spec/javascripts/fixtures/clusters.rb b/spec/javascripts/fixtures/clusters.rb
index be9d1d8f216..bf8ba8146da 100644
--- a/spec/javascripts/fixtures/clusters.rb
+++ b/spec/javascripts/fixtures/clusters.rb
@@ -31,5 +31,4 @@ describe Projects::ClustersController, '(JavaScript fixtures)', type: :controlle
     expect(response).to be_success
     store_frontend_fixture(response, example.description)
   end
-
 end
diff --git a/spec/models/gcp/cluster_spec.rb b/spec/models/gcp/cluster_spec.rb
index cf3036cefce..4b227a19bc2 100644
--- a/spec/models/gcp/cluster_spec.rb
+++ b/spec/models/gcp/cluster_spec.rb
@@ -34,7 +34,7 @@ describe Gcp::Cluster do
       end
 
       context 'when too long' do
-        let(:gcp_project_id) { 'A'*64 }
+        let(:gcp_project_id) { 'A' * 64 }
 
         it { is_expected.to be_falsey }
       end
@@ -62,7 +62,7 @@ describe Gcp::Cluster do
       end
 
       context 'when too long' do
-        let(:gcp_cluster_name) { 'A'*64 }
+        let(:gcp_cluster_name) { 'A' * 64 }
 
         it { is_expected.to be_falsey }
       end
@@ -106,7 +106,7 @@ describe Gcp::Cluster do
       end
 
       context 'when too long' do
-        let(:project_namespace) { 'A'*64 }
+        let(:project_namespace) { 'A' * 64 }
 
         it { is_expected.to be_falsey }
       end
diff --git a/spec/services/ci/create_cluster_service_spec.rb b/spec/services/ci/create_cluster_service_spec.rb
index a905ca9895f..6e7398fbffa 100644
--- a/spec/services/ci/create_cluster_service_spec.rb
+++ b/spec/services/ci/create_cluster_service_spec.rb
@@ -13,7 +13,7 @@ describe Ci::CreateClusterService do
           gcp_project_id: 'gcp-project',
           gcp_cluster_name: 'test-cluster',
           gcp_cluster_zone: 'us-central1-a',
-          gcp_cluster_size: 1,
+          gcp_cluster_size: 1
         }
       end
 
@@ -34,7 +34,7 @@ describe Ci::CreateClusterService do
           gcp_project_id: 'gcp-project',
           gcp_cluster_name: 'test-cluster',
           gcp_cluster_zone: 'us-central1-a',
-          gcp_cluster_size: 'ABC',
+          gcp_cluster_size: 'ABC'
         }
       end
 
diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
index eed6bec00f8..489dd769c12 100644
--- a/spec/workers/wait_for_cluster_creation_worker_spec.rb
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -8,7 +8,7 @@ describe WaitForClusterCreationWorker do
 
       before do
         allow(operation).to receive(:status).and_return(status)
-        allow(operation).to receive(:start_time).and_return(1.minutes.ago)
+        allow(operation).to receive(:start_time).and_return(1.minute.ago)
         allow(operation).to receive(:status_message).and_return('error')
         allow_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute).and_yield(operation)
       end
@@ -17,7 +17,7 @@ describe WaitForClusterCreationWorker do
         let(:status) { 'RUNNING' }
 
         it 'reschedules worker' do
-          expect(WaitForClusterCreationWorker).to receive(:perform_in)
+          expect(described_class).to receive(:perform_in)
 
           described_class.new.perform(cluster.id)
         end
-- 
cgit v1.2.1


From 07247601f3208fce65b3ac64ad3854dcc3dfd8c2 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 22:13:10 +0200
Subject: Remove status enum from Gcp::Cluster, use state_machine#state

---
 app/models/gcp/cluster.rb                  | 14 ++++++--------
 app/serializers/cluster_entity.rb          |  2 +-
 app/services/ci/create_cluster_service.rb  |  1 -
 app/views/projects/clusters/show.html.haml |  2 +-
 spec/factories/gcp/cluster.rb              |  6 ++++++
 5 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index f570c8b3c4c..fceda191880 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -25,13 +25,6 @@ module Gcp
       key: Gitlab::Application.secrets.db_key_base,
       algorithm: 'aes-256-cbc'
 
-    enum status: {
-      scheduled: 1,
-      creating: 2,
-      created: 3,
-      errored: 4
-    }
-
     validates :gcp_project_id,
       length: 1..63,
       format: {
@@ -67,6 +60,11 @@ module Gcp
     validate :restrict_modification, on: :update, unless: :status_changed?
 
     state_machine :status, initial: :scheduled do
+      state :scheduled, value: 1
+      state :creating, value: 2
+      state :created, value: 3
+      state :errored, value: 4
+
       event :make_creating do
         transition any - [:creating] => :creating
       end
@@ -86,7 +84,7 @@ module Gcp
 
       before_transition any => [:errored] do |cluster, transition|
         status_reason = transition.args.first
-        cluster.status_reason = status_reason
+        cluster.status_reason = status_reason if status_reason
       end
     end
 
diff --git a/app/serializers/cluster_entity.rb b/app/serializers/cluster_entity.rb
index ca0ee8952e2..08a113c4d8a 100644
--- a/app/serializers/cluster_entity.rb
+++ b/app/serializers/cluster_entity.rb
@@ -1,6 +1,6 @@
 class ClusterEntity < Grape::Entity
   include RequestAwareEntity
 
-  expose :status
+  expose :status_name, as: :status
   expose :status_reason
 end
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index 179dfa0c6bb..d01e167ecc3 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -5,7 +5,6 @@ module Ci
 
       project.create_cluster(
         params.merge(user: current_user,
-                     status: Gcp::Cluster.statuses[:scheduled],
                      gcp_token: access_token)).tap do |cluster|
         ClusterProvisionWorker.perform_async(cluster.id) if cluster.persisted?
       end
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index f160ce98b55..ecf43981c49 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -1,7 +1,7 @@
 - status_path = status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json) if can?(current_user, :admin_cluster, @cluster) && @cluster.on_creation?
 .row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { status_path: status_path,
   toggle_status: @cluster.enabled? ? 'true': 'false',
-  cluster_status: @cluster.status,
+  cluster_status: @cluster.status_name,
   cluster_status_reason: @cluster.status_reason }}
   = render 'sidebar'
   .col-lg-8
diff --git a/spec/factories/gcp/cluster.rb b/spec/factories/gcp/cluster.rb
index ea42c716649..2f98d024084 100644
--- a/spec/factories/gcp/cluster.rb
+++ b/spec/factories/gcp/cluster.rb
@@ -13,11 +13,17 @@ FactoryGirl.define do
     end
 
     trait :created_on_gke do
+      status_event :make_created
       endpoint '111.111.111.111'
       ca_cert 'xxxxxx'
       kubernetes_token 'xxxxxx'
       username 'xxxxxx'
       password 'xxxxxx'
     end
+
+    trait :errored do
+      status_event :make_errored
+      status_reason 'general error'
+    end
   end
 end
-- 
cgit v1.2.1


From 62545ddb2c1552de84c7c5c2b3fdfa8ca2c38a67 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 4 Oct 2017 22:32:03 +0200
Subject: Add serializers tests

---
 spec/serializers/cluster_entity_spec.rb     | 22 ++++++++++++++++++++++
 spec/serializers/cluster_serializer_spec.rb | 19 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 spec/serializers/cluster_entity_spec.rb
 create mode 100644 spec/serializers/cluster_serializer_spec.rb

diff --git a/spec/serializers/cluster_entity_spec.rb b/spec/serializers/cluster_entity_spec.rb
new file mode 100644
index 00000000000..2c7f49974f1
--- /dev/null
+++ b/spec/serializers/cluster_entity_spec.rb
@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+describe ClusterEntity do
+  set(:cluster) { create(:gcp_cluster, :errored) }
+  let(:request) { double('request') }
+
+  let(:entity) do
+    described_class.new(cluster)
+  end
+
+  describe '#as_json' do
+    subject { entity.as_json }
+
+    it 'contains status' do
+      expect(subject[:status]).to eq(:errored)
+    end
+
+    it 'contains status reason' do
+      expect(subject[:status_reason]).to eq('general error')
+    end
+  end
+end
diff --git a/spec/serializers/cluster_serializer_spec.rb b/spec/serializers/cluster_serializer_spec.rb
new file mode 100644
index 00000000000..1ac6784d28f
--- /dev/null
+++ b/spec/serializers/cluster_serializer_spec.rb
@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe ClusterSerializer do
+  let(:serializer) do
+    described_class.new
+  end
+
+  describe '#represent_status' do
+    subject { serializer.represent_status(resource) }
+
+    context 'when represents only status' do
+      let(:resource) { create(:gcp_cluster, :errored) }
+
+      it 'serializes only status' do
+        expect(subject.keys).to contain_exactly(:status, :status_reason)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 2fc45e4d7e7f476ed67d9e9b61e6c1c6820e7c00 Mon Sep 17 00:00:00 2001
From: "Vitaliy @blackst0ne Klachkov" <blackst0ne.ru@gmail.com>
Date: Thu, 5 Oct 2017 09:31:34 +1100
Subject: Replace the 'project/merge_requests.feature' spinach test with an
 rspec analog

---
 .../replace_project_merge_requests-feature.yml     |   5 +
 features/project/merge_requests.feature            | 324 -----------
 features/steps/project/merge_requests.rb           | 632 ---------------------
 .../merge_requests/user_posts_diff_notes_spec.rb   |  32 +-
 .../user_accepts_merge_request_spec.rb             |  19 +
 .../user_closes_merge_request_spec.rb              |  21 +
 .../merge_requests/user_comments_on_commit_spec.rb |  19 +
 .../merge_requests/user_comments_on_diff_spec.rb   | 172 ++++++
 .../user_comments_on_merge_request_spec.rb         |  50 ++
 .../user_creates_merge_request_spec.rb             |  32 ++
 .../user_edits_merge_request_spec.rb               |  25 +
 .../user_manages_subscription_spec.rb              |  32 ++
 .../user_reopens_merge_request_spec.rb             |  22 +
 .../user_sorts_merge_requests_spec.rb              |  63 ++
 .../user_views_all_merge_requests_spec.rb          |  15 +
 .../user_views_closed_merge_requests_spec.rb       |  15 +
 .../merge_requests/user_views_diffs_spec.rb        |  46 ++
 .../user_views_merged_merge_requests_spec.rb       |  15 +
 .../user_views_open_merge_request_spec.rb          |  92 +++
 .../user_views_open_merge_requests_spec.rb         |  72 +++
 spec/support/helpers/merge_request_diff_helpers.rb |  28 +
 ...ments_on_merge_request_files_shared_examples.rb |  28 +
 22 files changed, 773 insertions(+), 986 deletions(-)
 create mode 100644 changelogs/unreleased/replace_project_merge_requests-feature.yml
 delete mode 100644 features/project/merge_requests.feature
 delete mode 100644 features/steps/project/merge_requests.rb
 create mode 100644 spec/features/projects/merge_requests/user_closes_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_comments_on_commit_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_comments_on_diff_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_comments_on_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_creates_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_edits_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_manages_subscription_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_reopens_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_sorts_merge_requests_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_all_merge_requests_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_closed_merge_requests_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_diffs_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_merged_merge_requests_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_open_merge_request_spec.rb
 create mode 100644 spec/features/projects/merge_requests/user_views_open_merge_requests_spec.rb
 create mode 100644 spec/support/helpers/merge_request_diff_helpers.rb
 create mode 100644 spec/support/shared_examples/features/comments_on_merge_request_files_shared_examples.rb

diff --git a/changelogs/unreleased/replace_project_merge_requests-feature.yml b/changelogs/unreleased/replace_project_merge_requests-feature.yml
new file mode 100644
index 00000000000..082c922a32b
--- /dev/null
+++ b/changelogs/unreleased/replace_project_merge_requests-feature.yml
@@ -0,0 +1,5 @@
+---
+title: Replace the 'project/merge_requests.feature' spinach test with an rspec analog
+merge_request: 14621
+author: Vitaliy @blackst0ne Klachkov
+type: other
diff --git a/features/project/merge_requests.feature b/features/project/merge_requests.feature
deleted file mode 100644
index 349fa2663a7..00000000000
--- a/features/project/merge_requests.feature
+++ /dev/null
@@ -1,324 +0,0 @@
-@project_merge_requests
-Feature: Project Merge Requests
-  Background:
-    Given I sign in as a user
-    And I own project "Shop"
-    And project "Shop" have "Bug NS-04" open merge request
-    And project "Shop" have "Feature NS-03" closed merge request
-    And I visit project "Shop" merge requests page
-
-  Scenario: I should see open merge requests
-    Then I should see "Bug NS-04" in merge requests
-    And I should not see "Feature NS-03" in merge requests
-
-  Scenario: I should see CI status for merge requests
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    Given "Bug NS-05" has CI status
-    When I visit project "Shop" merge requests page
-    Then I should see merge request "Bug NS-05" with CI status
-
-  Scenario: I should not see target branch name when it is project's default branch
-    Then I should see "Bug NS-04" in merge requests
-    And I should not see "master" branch
-
-  Scenario: I should see target branch when it is different from default
-    Given project "Shop" have "Bug NS-06" open merge request
-    When I visit project "Shop" merge requests page
-    Then I should see "feature_conflict" branch
-
-  @javascript
-  Scenario: I should not see the numbers of diverged commits if the branch is rebased on the target
-    Given project "Shop" have "Bug NS-07" open merge request with rebased branch
-    When I visit merge request page "Bug NS-07"
-    Then I should not see the diverged commits count
-
-  @javascript
-  Scenario: I should see the numbers of diverged commits if the branch diverged from the target
-    Given project "Shop" have "Bug NS-08" open merge request with diverged branch
-    When I visit merge request page "Bug NS-08"
-    Then I should see the diverged commits count
-
-  @javascript
-  Scenario: I should see rejected merge requests
-    Given I click link "Closed"
-    Then I should see "Feature NS-03" in merge requests
-    And I should not see "Bug NS-04" in merge requests
-
-  @javascript
-  Scenario: I should see all merge requests
-    Given I click link "All"
-    Then I should see "Feature NS-03" in merge requests
-    And I should see "Bug NS-04" in merge requests
-
-  @javascript
-  Scenario: I visit an open merge request page
-    Given I click link "Bug NS-04"
-    Then I should see merge request "Bug NS-04"
-
-  @javascript
-  Scenario: I visit a merged merge request page
-    Given project "Shop" have "Feature NS-05" merged merge request
-    And I click link "Merged"
-    And I click link "Feature NS-05"
-    Then I should see merge request "Feature NS-05"
-
-  @javascript
-  Scenario: I close merge request page
-    Given I click link "Bug NS-04"
-    And I click link "Close"
-    Then I should see closed merge request "Bug NS-04"
-
-  @javascript
-  Scenario: I reopen merge request page
-    Given I click link "Bug NS-04"
-    And I click link "Close"
-    Then I should see closed merge request "Bug NS-04"
-    When I click link "Reopen"
-    Then I should see reopened merge request "Bug NS-04"
-
-  @javascript
-  Scenario: I submit new unassigned merge request
-    Given I click link "New Merge Request"
-    And I submit new merge request "Wiki Feature"
-    Then I should see merge request "Wiki Feature"
-
-  @javascript
-  Scenario: I comment on a merge request
-    Given I visit merge request page "Bug NS-04"
-    And I leave a comment like "XML attached"
-    Then I should see comment "XML attached"
-
-  @javascript
-  Scenario: Visiting Merge Requests after being sorted the list
-    Given I visit project "Shop" merge requests page
-    And I sort the list by "Last updated"
-    And I visit my project's home page
-    And I visit project "Shop" merge requests page
-    Then The list should be sorted by "Last updated"
-
-  @javascript
-  Scenario: Visiting Merge Requests from a different Project after sorting
-    Given I visit project "Shop" merge requests page
-    And I sort the list by "Last updated"
-    And I visit dashboard merge requests page
-    Then The list should be sorted by "Last updated"
-
-  @javascript
-  Scenario: Sort merge requests by upvotes
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And project "Shop" have "Bug NS-06" open merge request
-    And merge request "Bug NS-04" have 2 upvotes and 1 downvote
-    And merge request "Bug NS-06" have 1 upvote and 2 downvotes
-    And I sort the list by "Popularity"
-    Then The list should be sorted by "Popularity"
-
-  @javascript
-  Scenario: I comment on a merge request diff
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is wrong" on diff
-    And I switch to the merge request's comments tab
-    Then I should see a discussion has started on diff
-    And I should see a badge of "1" next to the discussion link
-
-  @javascript
-  Scenario: I see a new comment on merge request diff from another user in the discussion tab
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And user "John Doe" leaves a comment like "Line is wrong" on diff
-    Then I should see a discussion by user "John Doe" has started on diff
-    And I should see a badge of "1" next to the discussion link
-
-  @javascript
-  Scenario: I edit a comment on a merge request diff
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is wrong" on diff
-    And I change the comment "Line is wrong" to "Typo, please fix" on diff
-    Then I should not see a diff comment saying "Line is wrong"
-    And I should see a diff comment saying "Typo, please fix"
-
-  @javascript
-  Scenario: I delete a comment on a merge request diff
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is wrong" on diff
-    And I should see a badge of "1" next to the discussion link
-    And I delete the comment "Line is wrong" on diff
-    And I click on the Discussion tab
-    Then I should not see any discussion
-    And I should see a badge of "0" next to the discussion link
-
-  @javascript
-  Scenario: I comment on a line of a commit in merge request
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the commit in the merge request
-    And I leave a comment like "Line is wrong" on diff in commit
-    And I switch to the merge request's comments tab
-    Then I should see a discussion has started on commit diff
-
-  @javascript
-  Scenario: I comment on a commit in merge request
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the commit in the merge request
-    And I leave a comment on the diff page in commit
-    And I switch to the merge request's comments tab
-    Then I should see a discussion has started on commit
-
-  @javascript
-  Scenario: I accept merge request with custom commit message
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And merge request "Bug NS-05" is mergeable
-    And I visit merge request page "Bug NS-05"
-    And merge request is mergeable
-    Then I modify merge commit message
-    And I accept this merge request
-    Then I should see merged request
-
-  # Markdown
-
-  @javascript
-  Scenario: Headers inside the description should have ids generated for them.
-    When I visit merge request page "Bug NS-04"
-    Then Header "Description header" should have correct id and link
-
-  @javascript
-  Scenario: Headers inside comments should not have ids generated for them.
-    Given I visit merge request page "Bug NS-04"
-    And I leave a comment with a header containing "Comment with a header"
-    Then The comment with the header should not have an ID
-
-  # Toggling inline comments
-
-  @javascript
-  Scenario: I hide comments on a merge request diff with comments in a single file
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is wrong" on line 39 of the third file
-    And I click link "Hide inline discussion" of the third file
-    Then I should not see a comment like "Line is wrong here" in the third file
-
-  @javascript
-  Scenario: I show comments on a merge request diff with comments in a single file
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is wrong" on line 39 of the third file
-    Then I should see a comment like "Line is wrong" in the third file
-
-  @javascript
-  Scenario: I hide comments on a merge request diff with comments in multiple files
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is correct" on line 12 of the second file
-    And I leave a comment like "Line is wrong" on line 39 of the third file
-    And I click link "Hide inline discussion" of the third file
-    Then I should not see a comment like "Line is wrong here" in the third file
-    And I should still see a comment like "Line is correct" in the second file
-
-  @javascript
-  Scenario: I show comments on a merge request diff with comments in multiple files
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is correct" on line 12 of the second file
-    And I leave a comment like "Line is wrong" on line 39 of the third file
-    And I click link "Hide inline discussion" of the third file
-    And I click link "Show inline discussion" of the third file
-    Then I should see a comment like "Line is wrong" in the third file
-    And I should still see a comment like "Line is correct" in the second file
-
-  @javascript
-  Scenario: I unfold diff
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I unfold diff
-    Then I should see additional file lines
-
-  @javascript
-  Scenario: I unfold diff in Side-by-Side view
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I click Side-by-side Diff tab
-    And I unfold diff
-    Then I should see additional file lines
-
-  @javascript
-  Scenario: I show comments on a merge request side-by-side diff with comments in multiple files
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    And I leave a comment like "Line is correct" on line 12 of the second file
-    And I leave a comment like "Line is wrong" on line 39 of the third file
-    And I click Side-by-side Diff tab
-    Then I should see comments on the side-by-side diff page
-
-  @javascript
-  Scenario: I view diffs on a merge request
-    Given project "Shop" have "Bug NS-05" open merge request with diffs inside
-    And I visit merge request page "Bug NS-05"
-    And I click on the Changes tab
-    Then I should see the proper Inline and Side-by-side links
-
-  # Description preview
-
-  @javascript
-  Scenario: I can't preview without text
-    Given I visit merge request page "Bug NS-04"
-    And I click link "Edit" for the merge request
-    And I haven't written any description text
-    Then The Markdown preview tab should say there is nothing to do
-
-  @javascript
-  Scenario: I can preview with text
-    Given I visit merge request page "Bug NS-04"
-    And I click link "Edit" for the merge request
-    And I write a description like ":+1: Nice"
-    Then The Markdown preview tab should display rendered Markdown
-
-  @javascript
-  Scenario: I preview a merge request description
-    Given I visit merge request page "Bug NS-04"
-    And I click link "Edit" for the merge request
-    And I preview a description text like "Bug fixed :smile:"
-    Then I should see the Markdown preview
-    And I should not see the Markdown text field
-
-  @javascript
-  Scenario: I can edit after preview
-    Given I visit merge request page "Bug NS-04"
-    And I click link "Edit" for the merge request
-    And I preview a description text like "Bug fixed :smile:"
-    Then I should see the Markdown write tab
-
-  @javascript
-  Scenario: I can unsubscribe from merge request
-    Given I visit merge request page "Bug NS-04"
-    Then I should see that I am subscribed
-    When I click button "Unsubscribe"
-    Then I should see that I am unsubscribed
-
-  @javascript
-  Scenario: I can change the target branch
-    Given I visit merge request page "Bug NS-04"
-    And I click link "Edit" for the merge request
-    When I click the "Target branch" dropdown
-    And I select a new target branch
-    Then I should see new target branch changes
-
-  @javascript
-  Scenario: I can close merge request after commenting
-    Given I visit merge request page "Bug NS-04"
-    And I leave a comment like "XML attached"
-    Then I should see comment "XML attached"
-    And I click link "Close"
-    Then I should see closed merge request "Bug NS-04"
diff --git a/features/steps/project/merge_requests.rb b/features/steps/project/merge_requests.rb
deleted file mode 100644
index dde918e3d41..00000000000
--- a/features/steps/project/merge_requests.rb
+++ /dev/null
@@ -1,632 +0,0 @@
-class Spinach::Features::ProjectMergeRequests < Spinach::FeatureSteps
-  include SharedAuthentication
-  include SharedIssuable
-  include SharedProject
-  include SharedNote
-  include SharedPaths
-  include SharedMarkdown
-  include SharedDiffNote
-  include SharedUser
-  include WaitForRequests
-
-  after do
-    wait_for_requests if javascript_test?
-  end
-
-  step 'I click link "New Merge Request"' do
-    page.within '.nav-controls' do
-      page.has_link?('New Merge Request') ? click_link("New Merge Request") : click_link('New merge request')
-    end
-  end
-
-  step 'I click link "Bug NS-04"' do
-    click_link "Bug NS-04"
-  end
-
-  step 'I click link "Feature NS-05"' do
-    click_link "Feature NS-05"
-  end
-
-  step 'I click link "All"' do
-    find('.issues-state-filters [data-state="all"] span', text: 'All').click
-    # Waits for load
-    expect(find('.issues-state-filters > .active')).to have_content 'All'
-  end
-
-  step 'I click link "Merged"' do
-    find('#state-merged').trigger('click')
-  end
-
-  step 'I click link "Closed"' do
-    find('.issues-state-filters [data-state="closed"] span', text: 'Closed').click
-  end
-
-  step 'I should see merge request "Wiki Feature"' do
-    page.within '.merge-request' do
-      expect(page).to have_content "Wiki Feature"
-    end
-    wait_for_requests
-  end
-
-  step 'I should see closed merge request "Bug NS-04"' do
-    expect(page).to have_content "Bug NS-04"
-    expect(page).to have_content "Closed by"
-    wait_for_requests
-  end
-
-  step 'I should see merge request "Bug NS-04"' do
-    expect(page).to have_content "Bug NS-04"
-    wait_for_requests
-  end
-
-  step 'I should see merge request "Feature NS-05"' do
-    expect(page).to have_content "Feature NS-05"
-    wait_for_requests
-  end
-
-  step 'I should not see "master" branch' do
-    expect(find('.issuable-info')).not_to have_content "master"
-  end
-
-  step 'I should see "feature_conflict" branch' do
-    expect(page).to have_content "feature_conflict"
-  end
-
-  step 'I should see "Bug NS-04" in merge requests' do
-    expect(page).to have_content "Bug NS-04"
-  end
-
-  step 'I should see "Feature NS-03" in merge requests' do
-    expect(page).to have_content "Feature NS-03"
-  end
-
-  step 'I should not see "Feature NS-03" in merge requests' do
-    expect(page).not_to have_content "Feature NS-03"
-  end
-
-  step 'I should not see "Bug NS-04" in merge requests' do
-    expect(page).not_to have_content "Bug NS-04"
-  end
-
-  step 'I should see that I am subscribed' do
-    expect(find('.issuable-subscribe-button span')).to have_content 'Unsubscribe'
-  end
-
-  step 'I should see that I am unsubscribed' do
-    expect(find('.issuable-subscribe-button span')).to have_content 'Subscribe'
-  end
-
-  step 'I click button "Unsubscribe"' do
-    click_on "Unsubscribe"
-    wait_for_requests
-  end
-
-  step 'I click link "Close"' do
-    first(:css, '.close-mr-link').click
-  end
-
-  step 'I submit new merge request "Wiki Feature"' do
-    find('.js-source-branch').click
-    find('.dropdown-source-branch .dropdown-content a', text: 'fix').click
-
-    find('.js-target-branch').click
-    first('.dropdown-target-branch .dropdown-content a', text: 'feature').click
-
-    click_button "Compare branches"
-    fill_in "merge_request_title", with: "Wiki Feature"
-    click_button "Submit merge request"
-  end
-
-  step 'project "Shop" have "Bug NS-04" open merge request' do
-    create(:merge_request,
-           title: "Bug NS-04",
-           source_project: project,
-           target_project: project,
-           source_branch: 'fix',
-           target_branch: 'merge-test',
-           author: project.users.first,
-           description: "# Description header"
-          )
-  end
-
-  step 'project "Shop" have "Bug NS-06" open merge request' do
-    create(:merge_request,
-           title: "Bug NS-06",
-           source_project: project,
-           target_project: project,
-           source_branch: 'fix',
-           target_branch: 'feature_conflict',
-           author: project.users.first,
-           description: "# Description header"
-          )
-  end
-
-  step 'project "Shop" have "Bug NS-05" open merge request with diffs inside' do
-    create(:merge_request_with_diffs,
-           title: "Bug NS-05",
-           source_project: project,
-           target_project: project,
-           author: project.users.first,
-           source_branch: 'merge-test')
-  end
-
-  step 'project "Shop" have "Feature NS-05" merged merge request' do
-    create(:merged_merge_request,
-           title: "Feature NS-05",
-           source_project: project,
-           target_project: project,
-           author: project.users.first)
-  end
-
-  step 'project "Shop" have "Bug NS-07" open merge request with rebased branch' do
-    create(:merge_request, :rebased,
-      title: "Bug NS-07",
-      source_project: project,
-      target_project: project,
-      author: project.users.first)
-  end
-
-  step 'project "Shop" have "Bug NS-08" open merge request with diverged branch' do
-    create(:merge_request, :diverged,
-      title: "Bug NS-08",
-      source_project: project,
-      target_project: project,
-      author: project.users.first)
-  end
-
-  step 'project "Shop" have "Feature NS-03" closed merge request' do
-    create(:closed_merge_request,
-           title: "Feature NS-03",
-           source_project: project,
-           target_project: project,
-           author: project.users.first)
-  end
-
-  step 'project "Community" has "Bug CO-01" open merge request with diffs inside' do
-    project = Project.find_by(name: "Community")
-    create(:merge_request_with_diffs,
-           title: "Bug CO-01",
-           source_project: project,
-           target_project: project,
-           author: project.users.first)
-  end
-
-  step 'merge request "Bug NS-04" have 2 upvotes and 1 downvote' do
-    merge_request = MergeRequest.find_by(title: 'Bug NS-04')
-    create_list(:award_emoji, 2, awardable: merge_request)
-    create(:award_emoji, :downvote, awardable: merge_request)
-  end
-
-  step 'merge request "Bug NS-06" have 1 upvote and 2 downvotes' do
-    awardable = MergeRequest.find_by(title: 'Bug NS-06')
-    create(:award_emoji, awardable: awardable)
-    create_list(:award_emoji, 2, :downvote, awardable: awardable)
-  end
-
-  step 'The list should be sorted by "Least popular"' do
-    page.within '.mr-list' do
-      page.within 'li.merge-request:nth-child(1)' do
-        expect(page).to have_content 'Bug NS-06'
-        expect(page).to have_content '1 2'
-      end
-
-      page.within 'li.merge-request:nth-child(2)' do
-        expect(page).to have_content 'Bug NS-04'
-        expect(page).to have_content '2 1'
-      end
-
-      page.within 'li.merge-request:nth-child(3)' do
-        expect(page).to have_content 'Bug NS-05'
-        expect(page).not_to have_content '0 0'
-      end
-    end
-  end
-
-  step 'The list should be sorted by "Popularity"' do
-    page.within '.mr-list' do
-      page.within 'li.merge-request:nth-child(1)' do
-        expect(page).to have_content 'Bug NS-04'
-        expect(page).to have_content '2 1'
-      end
-
-      page.within 'li.merge-request:nth-child(2)' do
-        expect(page).to have_content 'Bug NS-06'
-        expect(page).to have_content '1 2'
-      end
-
-      page.within 'li.merge-request:nth-child(3)' do
-        expect(page).to have_content 'Bug NS-05'
-        expect(page).not_to have_content '0 0'
-      end
-    end
-  end
-
-  step 'I click on the Changes tab' do
-    page.within '.merge-request-tabs' do
-      click_link 'Changes'
-    end
-
-    # Waits for load
-    expect(page).to have_css('.tab-content #diffs.active')
-  end
-
-  step 'I should see the proper Inline and Side-by-side links' do
-    expect(page).to have_css('#parallel-diff-btn', count: 1)
-    expect(page).to have_css('#inline-diff-btn', count: 1)
-  end
-
-  step 'I switch to the merge request\'s comments tab' do
-    visit project_merge_request_path(project, merge_request)
-  end
-
-  step 'I click on the commit in the merge request' do
-    page.within '.merge-request-tabs' do
-      click_link 'Commits'
-    end
-
-    page.within '.commits' do
-      click_link Commit.truncate_sha(sample_commit.id)
-    end
-  end
-
-  step 'I leave a comment on the diff page' do
-    init_diff_note
-    leave_comment "One comment to rule them all"
-  end
-
-  step 'I leave a comment on the diff page in commit' do
-    click_diff_line(sample_commit.line_code)
-    leave_comment "One comment to rule them all"
-  end
-
-  step 'I leave a comment like "Line is wrong" on diff' do
-    init_diff_note
-    leave_comment "Line is wrong"
-  end
-
-  step 'user "John Doe" leaves a comment like "Line is wrong" on diff' do
-    mr = MergeRequest.find_by(title: "Bug NS-05")
-    create(:diff_note_on_merge_request, project: project,
-                                        noteable: mr,
-                                        author: user_exists("John Doe"),
-                                        note: 'Line is wrong')
-  end
-
-  step 'I leave a comment like "Line is wrong" on diff in commit' do
-    click_diff_line(sample_commit.line_code)
-    leave_comment "Line is wrong"
-  end
-
-  step 'I change the comment "Line is wrong" to "Typo, please fix" on diff' do
-    page.within('.diff-file:nth-of-type(5) .note') do
-      find('.js-note-edit').click
-
-      page.within('.current-note-edit-form', visible: true) do
-        fill_in 'note_note', with: 'Typo, please fix'
-        click_button 'Save comment'
-      end
-
-      expect(page).not_to have_button 'Save comment', disabled: true, visible: true
-    end
-  end
-
-  step 'I should not see a diff comment saying "Line is wrong"' do
-    page.within('.diff-file:nth-of-type(5) .note') do
-      expect(page).not_to have_visible_content 'Line is wrong'
-    end
-  end
-
-  step 'I should see a diff comment saying "Typo, please fix"' do
-    page.within('.diff-file:nth-of-type(5) .note') do
-      expect(page).to have_visible_content 'Typo, please fix'
-    end
-  end
-
-  step 'I delete the comment "Line is wrong" on diff' do
-    page.within('.diff-file:nth-of-type(5) .note') do
-      find('.more-actions').click
-      find('.more-actions .dropdown-menu li', match: :first)
-
-      find('.js-note-delete').click
-    end
-  end
-
-  step 'I click on the Discussion tab' do
-    page.within '.merge-request-tabs' do
-      find('.notes-tab').trigger('click')
-    end
-
-    # Waits for load
-    expect(page).to have_css('.tab-content #notes.active')
-  end
-
-  step 'I should not see any discussion' do
-    expect(page).not_to have_css('.notes .discussion')
-  end
-
-  step 'I should see a discussion has started on diff' do
-    page.within(".notes .discussion") do
-      page.should have_content "#{current_user.name} #{current_user.to_reference} started a discussion"
-      page.should have_content sample_commit.line_code_path
-      page.should have_content "Line is wrong"
-    end
-  end
-
-  step 'I should see a discussion by user "John Doe" has started on diff' do
-    # Trigger a refresh of notes
-    execute_script("$(document).trigger('visibilitychange');")
-    wait_for_requests
-    page.within(".notes .discussion") do
-      page.should have_content "#{user_exists("John Doe").name} #{user_exists("John Doe").to_reference} started a discussion"
-      page.should have_content sample_commit.line_code_path
-      page.should have_content "Line is wrong"
-    end
-  end
-
-  step 'I should see a badge of "1" next to the discussion link' do
-    expect_discussion_badge_to_have_counter("1")
-    wait_for_requests
-  end
-
-  step 'I should see a badge of "0" next to the discussion link' do
-    expect_discussion_badge_to_have_counter("0")
-    wait_for_requests
-  end
-
-  step 'I should see a discussion has started on commit diff' do
-    page.within(".notes .discussion") do
-      page.should have_content "#{current_user.name} #{current_user.to_reference} started a discussion on commit"
-      page.should have_content sample_commit.line_code_path
-      page.should have_content "Line is wrong"
-      wait_for_requests
-    end
-  end
-
-  step 'I should see a discussion has started on commit' do
-    page.within(".notes .discussion") do
-      page.should have_content "#{current_user.name} #{current_user.to_reference} started a discussion on commit"
-      page.should have_content "One comment to rule them all"
-      wait_for_requests
-    end
-  end
-
-  step 'merge request is mergeable' do
-    expect(page).to have_button 'Merge'
-  end
-
-  step 'I modify merge commit message' do
-    click_button "Modify commit message"
-    fill_in 'Commit message', with: 'wow such merge'
-  end
-
-  step 'merge request "Bug NS-05" is mergeable' do
-    merge_request.mark_as_mergeable
-  end
-
-  step 'I accept this merge request' do
-    page.within '.mr-state-widget' do
-      click_button "Merge"
-    end
-  end
-
-  step 'I should see merged request' do
-    page.within '.status-box' do
-      expect(page).to have_content "Merged"
-      wait_for_requests
-    end
-  end
-
-  step 'I click link "Reopen"' do
-    first(:css, '.reopen-mr-link').trigger('click')
-  end
-
-  step 'I should see reopened merge request "Bug NS-04"' do
-    page.within '.status-box' do
-      expect(page).to have_content "Open"
-    end
-    wait_for_requests
-  end
-
-  step 'I click link "Hide inline discussion" of the third file' do
-    page.within '.files>div:nth-child(3)' do
-      find('.js-toggle-diff-comments').trigger('click')
-    end
-  end
-
-  step 'I click link "Show inline discussion" of the third file' do
-    page.within '.files>div:nth-child(3)' do
-      find('.js-toggle-diff-comments').trigger('click')
-    end
-  end
-
-  step 'I should not see a comment like "Line is wrong" in the third file' do
-    page.within '.files>div:nth-child(3)' do
-      expect(page).not_to have_visible_content "Line is wrong"
-    end
-  end
-
-  step 'I should see a comment like "Line is wrong" in the third file' do
-    page.within '.files>div:nth-child(3) .note-body > .note-text' do
-      expect(page).to have_visible_content "Line is wrong"
-      wait_for_requests
-    end
-  end
-
-  step 'I should not see a comment like "Line is wrong here" in the third file' do
-    page.within '.files>div:nth-child(3)' do
-      expect(page).not_to have_visible_content "Line is wrong here"
-    end
-  end
-
-  step 'I should see a comment like "Line is wrong here" in the third file' do
-    page.within '.files>div:nth-child(3) .note-body > .note-text' do
-      expect(page).to have_visible_content "Line is wrong here"
-    end
-  end
-
-  step 'I leave a comment like "Line is correct" on line 12 of the second file' do
-    init_diff_note_first_file
-
-    page.within(".js-discussion-note-form") do
-      fill_in "note_note", with: "Line is correct"
-      click_button "Comment"
-    end
-
-    wait_for_requests
-
-    page.within ".files>div:nth-child(2) .note-body > .note-text" do
-      expect(page).to have_content "Line is correct"
-    end
-  end
-
-  step 'I leave a comment like "Line is wrong" on line 39 of the third file' do
-    init_diff_note_second_file
-
-    page.within(".js-discussion-note-form") do
-      fill_in "note_note", with: "Line is wrong on here"
-      click_button "Comment"
-    end
-
-    wait_for_requests
-  end
-
-  step 'I should still see a comment like "Line is correct" in the second file' do
-    page.within '.files>div:nth-child(2) .note-body > .note-text' do
-      expect(page).to have_visible_content "Line is correct"
-    end
-  end
-
-  step 'I unfold diff' do
-    expect(page).to have_css('.js-unfold')
-
-    first('.js-unfold').click
-  end
-
-  step 'I should see additional file lines' do
-    expect(first('.text-file')).to have_content('.bundle')
-  end
-
-  step 'I click Side-by-side Diff tab' do
-    find('a', text: 'Side-by-side').trigger('click')
-
-    # Waits for load
-    expect(page).to have_css('.parallel')
-  end
-
-  step 'I should see comments on the side-by-side diff page' do
-    page.within '.files>div:nth-child(2) .parallel .note-body > .note-text' do
-      expect(page).to have_visible_content "Line is correct"
-      wait_for_requests
-    end
-  end
-
-  step 'I fill in merge request search with "Fe"' do
-    fill_in 'issuable_search', with: "Fe"
-    page.within '.merge-requests-holder' do
-      find('.merge-request')
-    end
-  end
-
-  step 'I click the "Target branch" dropdown' do
-    expect(page).to have_content('Target branch')
-    first('.target_branch').click
-  end
-
-  step 'I select a new target branch' do
-    select "feature", from: "merge_request_target_branch"
-    click_button 'Save'
-  end
-
-  step 'I should see new target branch changes' do
-    expect(page).to have_content 'Request to merge fix into feature'
-    expect(page).to have_content 'changed target branch from merge-test to feature'
-    wait_for_requests
-  end
-
-  step 'I click on "Email Patches"' do
-    click_link "Email Patches"
-  end
-
-  step 'I click on "Plain Diff"' do
-    click_link "Plain Diff"
-  end
-
-  step 'I should see a patch diff' do
-    expect(page).to have_content('diff --git')
-  end
-
-  step '"Bug NS-05" has CI status' do
-    project = merge_request.source_project
-    project.enable_ci
-
-    pipeline =
-      create(:ci_pipeline,
-             project: project,
-             sha: merge_request.diff_head_sha,
-             ref: merge_request.source_branch,
-             head_pipeline_of: merge_request)
-
-    create :ci_build, pipeline: pipeline
-  end
-
-  step 'I should see merge request "Bug NS-05" with CI status' do
-    page.within ".mr-list" do
-      expect(page).to have_link "Pipeline: pending"
-    end
-  end
-
-  step 'I should see the diverged commits count' do
-    page.within ".mr-source-target" do
-      expect(page).to have_content /([0-9]+ commits behind)/
-    end
-
-    wait_for_requests
-  end
-
-  step 'I should not see the diverged commits count' do
-    page.within ".mr-source-target" do
-      expect(page).not_to have_content /([0-9]+ commit[s]? behind)/
-    end
-
-    wait_for_requests
-  end
-
-  def merge_request
-    @merge_request ||= MergeRequest.find_by!(title: "Bug NS-05")
-  end
-
-  def init_diff_note
-    click_diff_line(sample_commit.line_code)
-  end
-
-  def leave_comment(message)
-    page.within(".js-discussion-note-form", visible: true) do
-      fill_in "note_note", with: message
-      click_button "Comment"
-    end
-
-    wait_for_requests
-
-    page.within(".notes_holder", visible: true) do
-      expect(page).to have_content message
-    end
-  end
-
-  def init_diff_note_first_file
-    click_diff_line(sample_compare.changes[0][:line_code])
-  end
-
-  def init_diff_note_second_file
-    click_diff_line(sample_compare.changes[1][:line_code])
-  end
-
-  def have_visible_content(text)
-    have_css("*", text: text, visible: true)
-  end
-
-  def expect_discussion_badge_to_have_counter(value)
-    page.within(".notes-tab .badge") do
-      page.should have_content value
-    end
-  end
-end
diff --git a/spec/features/merge_requests/user_posts_diff_notes_spec.rb b/spec/features/merge_requests/user_posts_diff_notes_spec.rb
index 2fb6d0b965f..e1ca4fe186c 100644
--- a/spec/features/merge_requests/user_posts_diff_notes_spec.rb
+++ b/spec/features/merge_requests/user_posts_diff_notes_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 feature 'Merge requests > User posts diff notes', :js do
+  include MergeRequestDiffHelpers
+
   let(:user) { create(:user) }
   let(:merge_request) { create(:merge_request) }
   let(:project) { merge_request.source_project }
@@ -244,36 +246,6 @@ feature 'Merge requests > User posts diff notes', :js do
     expect(line[:num]).not_to have_css comment_button_class
   end
 
-  def get_line_components(line_holder, diff_side = nil)
-    if diff_side.nil?
-      get_inline_line_components(line_holder)
-    else
-      get_parallel_line_components(line_holder, diff_side)
-    end
-  end
-
-  def get_inline_line_components(line_holder)
-    { content: line_holder.find('.line_content', match: :first), num: line_holder.find('.diff-line-num', match: :first) }
-  end
-
-  def get_parallel_line_components(line_holder, diff_side = nil)
-    side_index = diff_side == 'left' ? 0 : 1
-    # Wait for `.line_content`
-    line_holder.find('.line_content', match: :first)
-    # Wait for `.diff-line-num`
-    line_holder.find('.diff-line-num', match: :first)
-    { content: line_holder.all('.line_content')[side_index], num: line_holder.all('.diff-line-num')[side_index] }
-  end
-
-  def click_diff_line(line_holder, diff_side = nil)
-    line = get_line_components(line_holder, diff_side)
-    line[:content].hover
-
-    expect(line[:num]).to have_css comment_button_class
-
-    line[:num].find(comment_button_class).trigger 'click'
-  end
-
   def write_comment_on_line(line_holder, diff_side)
     click_diff_line(line_holder, diff_side)
 
diff --git a/spec/features/projects/merge_requests/user_accepts_merge_request_spec.rb b/spec/features/projects/merge_requests/user_accepts_merge_request_spec.rb
index 6c0b5e279d5..c35ba2d7016 100644
--- a/spec/features/projects/merge_requests/user_accepts_merge_request_spec.rb
+++ b/spec/features/projects/merge_requests/user_accepts_merge_request_spec.rb
@@ -62,4 +62,23 @@ describe 'User accepts a merge request', :js do
       wait_for_requests
     end
   end
+
+  context 'when modifying the merge commit message' do
+    before do
+      merge_request.mark_as_mergeable
+
+      visit(merge_request_path(merge_request))
+    end
+
+    it 'accepts a merge request' do
+      click_button('Modify commit message')
+      fill_in('Commit message', with: 'wow such merge')
+
+      click_button('Merge')
+
+      page.within('.status-box') do
+        expect(page).to have_content('Merged')
+      end
+    end
+  end
 end
diff --git a/spec/features/projects/merge_requests/user_closes_merge_request_spec.rb b/spec/features/projects/merge_requests/user_closes_merge_request_spec.rb
new file mode 100644
index 00000000000..b257f447439
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_closes_merge_request_spec.rb
@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+describe 'User closes a merge requests', :js do
+  let(:project) { create(:project, :repository) }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(merge_request_path(merge_request))
+  end
+
+  it 'closes a merge request' do
+    click_link('Close merge request', match: :first)
+
+    expect(page).to have_content(merge_request.title)
+    expect(page).to have_content('Closed by')
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_comments_on_commit_spec.rb b/spec/features/projects/merge_requests/user_comments_on_commit_spec.rb
new file mode 100644
index 00000000000..0a952cfc2a9
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_comments_on_commit_spec.rb
@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe 'User comments on a commit', :js do
+  include MergeRequestDiffHelpers
+  include RepoHelpers
+
+  let(:project) { create(:project, :repository) }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(project_commit_path(project, sample_commit.id))
+  end
+
+  include_examples 'comment on merge request file'
+end
diff --git a/spec/features/projects/merge_requests/user_comments_on_diff_spec.rb b/spec/features/projects/merge_requests/user_comments_on_diff_spec.rb
new file mode 100644
index 00000000000..f34302f25f8
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_comments_on_diff_spec.rb
@@ -0,0 +1,172 @@
+require 'spec_helper'
+
+describe 'User comments on a diff', :js do
+  include MergeRequestDiffHelpers
+  include RepoHelpers
+
+  let(:project) { create(:project, :repository) }
+  let(:merge_request) do
+    create(:merge_request_with_diffs, source_project: project, target_project: project, source_branch: 'merge-test')
+  end
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(diffs_project_merge_request_path(project, merge_request))
+  end
+
+  context 'when viewing comments' do
+    context 'when toggling inline comments' do
+      context 'in a single file' do
+        it 'hides a comment' do
+          click_diff_line(find("[id='#{sample_compare.changes[1][:line_code]}']"))
+
+          page.within('.js-discussion-note-form') do
+            fill_in('note_note', with: 'Line is wrong')
+            click_button('Comment')
+          end
+
+          page.within('.files > div:nth-child(3)') do
+            expect(page).to have_content('Line is wrong')
+
+            find('.js-toggle-diff-comments').trigger('click')
+
+            expect(page).not_to have_content('Line is wrong')
+          end
+        end
+      end
+
+      context 'in multiple files' do
+        it 'toggles comments' do
+          click_diff_line(find("[id='#{sample_compare.changes[0][:line_code]}']"))
+
+          page.within('.js-discussion-note-form') do
+            fill_in('note_note', with: 'Line is correct')
+            click_button('Comment')
+          end
+
+          wait_for_requests
+
+          page.within('.files > div:nth-child(2) .note-body > .note-text') do
+            expect(page).to have_content('Line is correct')
+          end
+
+          click_diff_line(find("[id='#{sample_compare.changes[1][:line_code]}']"))
+
+          page.within('.js-discussion-note-form') do
+            fill_in('note_note', with: 'Line is wrong')
+            click_button('Comment')
+          end
+
+          wait_for_requests
+
+          # Hide the comment.
+          page.within('.files > div:nth-child(3)') do
+            find('.js-toggle-diff-comments').trigger('click')
+
+            expect(page).not_to have_content('Line is wrong')
+          end
+
+          # At this moment a user should see only one comment.
+          # The other one should be hidden.
+          page.within('.files > div:nth-child(2) .note-body > .note-text') do
+            expect(page).to have_content('Line is correct')
+          end
+
+          # Show the comment.
+          page.within('.files > div:nth-child(3)') do
+            find('.js-toggle-diff-comments').trigger('click')
+          end
+
+          # Now both the comments should be shown.
+          page.within('.files > div:nth-child(3) .note-body > .note-text') do
+            expect(page).to have_content('Line is wrong')
+          end
+
+          page.within('.files > div:nth-child(2) .note-body > .note-text') do
+            expect(page).to have_content('Line is correct')
+          end
+
+          # Check the same comments in the side-by-side view.
+          click_link('Side-by-side')
+
+          wait_for_requests
+
+          page.within('.files > div:nth-child(3) .parallel .note-body > .note-text') do
+            expect(page).to have_content('Line is wrong')
+          end
+
+          page.within('.files > div:nth-child(2) .parallel .note-body > .note-text') do
+            expect(page).to have_content('Line is correct')
+          end
+        end
+      end
+    end
+  end
+
+  context 'when adding comments' do
+    include_examples 'comment on merge request file'
+  end
+
+  context 'when editing comments' do
+    it 'edits a comment' do
+      click_diff_line(find("[id='#{sample_commit.line_code}']"))
+
+      page.within('.js-discussion-note-form') do
+        fill_in(:note_note, with: 'Line is wrong')
+        click_button('Comment')
+      end
+
+      page.within('.diff-file:nth-of-type(5) .note') do
+        find('.js-note-edit').click
+
+        page.within('.current-note-edit-form') do
+          fill_in('note_note', with: 'Typo, please fix')
+          click_button('Save comment')
+        end
+
+        expect(page).not_to have_button('Save comment', disabled: true)
+      end
+
+      page.within('.diff-file:nth-of-type(5) .note') do
+        expect(page).to have_content('Typo, please fix').and have_no_content('Line is wrong')
+      end
+    end
+  end
+
+  context 'when deleting comments' do
+    it 'deletes a comment' do
+      click_diff_line(find("[id='#{sample_commit.line_code}']"))
+
+      page.within('.js-discussion-note-form') do
+        fill_in(:note_note, with: 'Line is wrong')
+        click_button('Comment')
+      end
+
+      page.within('.notes-tab .badge') do
+        expect(page).to have_content('1')
+      end
+
+      page.within('.diff-file:nth-of-type(5) .note') do
+        find('.more-actions').click
+        find('.more-actions .dropdown-menu li', match: :first)
+
+        find('.js-note-delete').click
+      end
+
+      page.within('.merge-request-tabs') do
+        find('.notes-tab').trigger('click')
+      end
+
+      wait_for_requests
+
+      expect(page).not_to have_css('.notes .discussion')
+
+      page.within('.notes-tab .badge') do
+        expect(page).to have_content('0')
+      end
+    end
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_comments_on_merge_request_spec.rb b/spec/features/projects/merge_requests/user_comments_on_merge_request_spec.rb
new file mode 100644
index 00000000000..2eb652147ce
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_comments_on_merge_request_spec.rb
@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'User comments on a merge request', :js do
+  include RepoHelpers
+
+  let(:project) { create(:project, :repository) }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(merge_request_path(merge_request))
+  end
+
+  it 'adds a comment' do
+    page.within('.js-main-target-form') do
+      fill_in(:note_note, with: '# Comment with a header')
+      click_button('Comment')
+    end
+
+    wait_for_requests
+
+    page.within('.note') do
+      expect(page).to have_content('Comment with a header')
+      expect(page).not_to have_css('#comment-with-a-header')
+    end
+  end
+
+  it 'loads new comment' do
+    # Add new comment in background in order to check
+    # if it's going to be loaded automatically for current user.
+    create(:diff_note_on_merge_request, project: project, noteable: merge_request, author: user, note: 'Line is wrong')
+
+    # Trigger a refresh of notes.
+    execute_script("$(document).trigger('visibilitychange');")
+    wait_for_requests
+
+    page.within('.notes .discussion') do
+      expect(page).to have_content("#{user.name} #{user.to_reference} started a discussion")
+      expect(page).to have_content(sample_commit.line_code_path)
+      expect(page).to have_content('Line is wrong')
+    end
+
+    page.within('.notes-tab .badge') do
+      expect(page).to have_content('1')
+    end
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_creates_merge_request_spec.rb b/spec/features/projects/merge_requests/user_creates_merge_request_spec.rb
new file mode 100644
index 00000000000..f285c6c8783
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_creates_merge_request_spec.rb
@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe 'User creates a merge request', :js do
+  let(:project) { create(:project, :repository) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(project_new_merge_request_path(project))
+  end
+
+  it 'creates a merge request' do
+    find('.js-source-branch').click
+    click_link('fix')
+
+    find('.js-target-branch').click
+    click_link('feature')
+
+    click_button('Compare branches')
+
+    fill_in('merge_request_title', with: 'Wiki Feature')
+    click_button('Submit merge request')
+
+    page.within('.merge-request') do
+      expect(page).to have_content('Wiki Feature')
+    end
+
+    wait_for_requests
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_edits_merge_request_spec.rb b/spec/features/projects/merge_requests/user_edits_merge_request_spec.rb
new file mode 100644
index 00000000000..f6e3997383f
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_edits_merge_request_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe 'User edits a merge request', :js do
+  let(:project) { create(:project, :repository) }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(edit_project_merge_request_path(project, merge_request))
+  end
+
+  it 'changes the target branch' do
+    expect(page).to have_content('Target branch')
+
+    first('.target_branch').click
+    select('merge-test', from: 'merge_request_target_branch', visible: false)
+    click_button('Save changes')
+
+    expect(page).to have_content("Request to merge #{merge_request.source_branch} into merge-test")
+    expect(page).to have_content("changed target branch from #{merge_request.target_branch} to merge-test")
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_manages_subscription_spec.rb b/spec/features/projects/merge_requests/user_manages_subscription_spec.rb
new file mode 100644
index 00000000000..30a80f8e652
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_manages_subscription_spec.rb
@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe 'User manages subscription', :js do
+  let(:project) { create(:project, :public, :repository) }
+  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(merge_request_path(merge_request))
+  end
+
+  it 'toggles subscription' do
+    subscribe_button = find('.issuable-subscribe-button span')
+
+    expect(subscribe_button).to have_content('Subscribe')
+
+    click_on('Subscribe')
+
+    wait_for_requests
+
+    expect(subscribe_button).to have_content('Unsubscribe')
+
+    click_on('Unsubscribe')
+
+    wait_for_requests
+
+    expect(subscribe_button).to have_content('Subscribe')
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_reopens_merge_request_spec.rb b/spec/features/projects/merge_requests/user_reopens_merge_request_spec.rb
new file mode 100644
index 00000000000..ba3c9789da1
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_reopens_merge_request_spec.rb
@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+describe 'User reopens a merge requests', :js do
+  let(:project) { create(:project, :public, :repository) }
+  let!(:merge_request) { create(:closed_merge_request, source_project: project, target_project: project) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(merge_request_path(merge_request))
+  end
+
+  it 'reopens a merge request' do
+    click_link('Reopen merge request', match: :first)
+
+    page.within('.status-box') do
+      expect(page).to have_content('Open')
+    end
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_sorts_merge_requests_spec.rb b/spec/features/projects/merge_requests/user_sorts_merge_requests_spec.rb
new file mode 100644
index 00000000000..d8d9f7e2a8c
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_sorts_merge_requests_spec.rb
@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe 'User sorts merge requests' do
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let!(:merge_request2) do
+    create(:merge_request_with_diffs, source_project: project, target_project: project, source_branch: 'merge-test')
+  end
+  let(:project) { create(:project, :public, :repository) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    sign_in(user)
+
+    visit(project_merge_requests_path(project))
+  end
+
+  it 'keeps the sort option' do
+    find('button.dropdown-toggle').click
+
+    page.within('.content ul.dropdown-menu.dropdown-menu-align-right li') do
+      click_link('Last updated')
+    end
+
+    visit(merge_requests_dashboard_path(assignee_id: user.id))
+
+    expect(find('.issues-filters')).to have_content('Last updated')
+
+    visit(project_merge_requests_path(project))
+
+    expect(find('.issues-filters')).to have_content('Last updated')
+  end
+
+  context 'when merge requests have awards' do
+    before do
+      create_list(:award_emoji, 2, awardable: merge_request)
+      create(:award_emoji, :downvote, awardable: merge_request)
+
+      create(:award_emoji, awardable: merge_request2)
+      create_list(:award_emoji, 2, :downvote, awardable: merge_request2)
+    end
+
+    it 'sorts by popularity' do
+      find('button.dropdown-toggle').click
+
+      page.within('.content ul.dropdown-menu.dropdown-menu-align-right li') do
+        click_link('Popularity')
+      end
+
+      page.within('.mr-list') do
+        page.within('li.merge-request:nth-child(1)') do
+          expect(page).to have_content(merge_request.title)
+          expect(page).to have_content('2 1')
+        end
+
+        page.within('li.merge-request:nth-child(2)') do
+          expect(page).to have_content(merge_request2.title)
+          expect(page).to have_content('1 2')
+        end
+      end
+    end
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_all_merge_requests_spec.rb b/spec/features/projects/merge_requests/user_views_all_merge_requests_spec.rb
new file mode 100644
index 00000000000..6c695bd7aa9
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_all_merge_requests_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe 'User views all merge requests' do
+  let!(:closed_merge_request) { create(:closed_merge_request, source_project: project, target_project: project) }
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:project) { create(:project, :public) }
+
+  before do
+    visit(project_merge_requests_path(project, state: :all))
+  end
+
+  it 'shows all merge requests' do
+    expect(page).to have_content(merge_request.title).and have_content(closed_merge_request.title)
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_closed_merge_requests_spec.rb b/spec/features/projects/merge_requests/user_views_closed_merge_requests_spec.rb
new file mode 100644
index 00000000000..853809fe87a
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_closed_merge_requests_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe 'User views closed merge requests' do
+  let!(:closed_merge_request) { create(:closed_merge_request, source_project: project, target_project: project) }
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let(:project) { create(:project, :public) }
+
+  before do
+    visit(project_merge_requests_path(project, state: :closed))
+  end
+
+  it 'shows closed merge requests' do
+    expect(page).to have_content(closed_merge_request.title).and have_no_content(merge_request.title)
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_diffs_spec.rb b/spec/features/projects/merge_requests/user_views_diffs_spec.rb
new file mode 100644
index 00000000000..295eb02b625
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_diffs_spec.rb
@@ -0,0 +1,46 @@
+require 'spec_helper'
+
+describe 'User views diffs', :js do
+  let(:merge_request) do
+    create(:merge_request_with_diffs, source_project: project, target_project: project, source_branch: 'merge-test')
+  end
+  let(:project) { create(:project, :public, :repository) }
+
+  before do
+    visit(diffs_project_merge_request_path(project, merge_request))
+
+    wait_for_requests
+  end
+
+  shared_examples 'unfold diffs' do
+    it 'unfolds diffs' do
+      first('.js-unfold').click
+
+      expect(first('.text-file')).to have_content('.bundle')
+    end
+  end
+
+  it 'shows diffs' do
+    expect(page).to have_css('.tab-content #diffs.active')
+    expect(page).to have_css('#parallel-diff-btn', count: 1)
+    expect(page).to have_css('#inline-diff-btn', count: 1)
+  end
+
+  context 'when in the inline view' do
+    include_examples 'unfold diffs'
+  end
+
+  context 'when in the side-by-side view' do
+    before do
+      click_link('Side-by-side')
+
+      wait_for_requests
+    end
+
+    it 'shows diffs in parallel' do
+      expect(page).to have_css('.parallel')
+    end
+
+    include_examples 'unfold diffs'
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_merged_merge_requests_spec.rb b/spec/features/projects/merge_requests/user_views_merged_merge_requests_spec.rb
new file mode 100644
index 00000000000..eb012694f1e
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_merged_merge_requests_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe 'User views merged merge requests' do
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let!(:merged_merge_request) { create(:merged_merge_request, source_project: project, target_project: project) }
+  let(:project) { create(:project, :public) }
+
+  before do
+    visit(project_merge_requests_path(project, state: :merged))
+  end
+
+  it 'shows merged merge requests' do
+    expect(page).to have_content(merged_merge_request.title).and have_no_content(merge_request.title)
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_open_merge_request_spec.rb b/spec/features/projects/merge_requests/user_views_open_merge_request_spec.rb
new file mode 100644
index 00000000000..8970cf54457
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_open_merge_request_spec.rb
@@ -0,0 +1,92 @@
+require 'spec_helper'
+
+describe 'User views an open merge request' do
+  let(:merge_request) do
+    create(:merge_request, source_project: project, target_project: project, description: '# Description header')
+  end
+
+  context 'when a merge request does not have repository' do
+    let(:project) { create(:project, :public) }
+
+    before do
+      visit(merge_request_path(merge_request))
+    end
+
+    it 'renders both the title and the description' do
+      node = find('.wiki h1 a#user-content-description-header')
+      expect(node[:href]).to end_with('#description-header')
+
+      # Work around a weird Capybara behavior where calling `parent` on a node
+      # returns the whole document, not the node's actual parent element
+      expect(find(:xpath, "#{node.path}/..").text).to eq(merge_request.description[2..-1])
+
+      expect(page).to have_content(merge_request.title).and have_content(merge_request.description)
+    end
+  end
+
+  context 'when a merge request has repository', :js do
+    let(:project) { create(:project, :public, :repository) }
+
+    context 'when rendering description preview' do
+      let(:user) { create(:user) }
+
+      before do
+        project.add_master(user)
+        sign_in(user)
+
+        visit(edit_project_merge_request_path(project, merge_request))
+      end
+
+      it 'renders empty description preview' do
+        find('.gfm-form').fill_in(:merge_request_description, with: '')
+
+        page.within('.gfm-form') do
+          click_link('Preview')
+
+          expect(find('.js-md-preview')).to have_content('Nothing to preview.')
+        end
+      end
+
+      it 'renders description preview' do
+        find('.gfm-form').fill_in(:merge_request_description, with: ':+1: Nice')
+
+        page.within('.gfm-form') do
+          click_link('Preview')
+
+          expect(find('.js-md-preview')).to have_css('gl-emoji')
+        end
+
+        expect(find('.gfm-form')).to have_css('.js-md-preview').and have_link('Write')
+        expect(find('#merge_request_description', visible: false)).not_to be_visible
+      end
+    end
+
+    context 'when the branch is rebased on the target' do
+      let(:merge_request) { create(:merge_request, :rebased, source_project: project, target_project: project) }
+
+      before do
+        visit(merge_request_path(merge_request))
+      end
+
+      it 'does not show diverged commits count' do
+        page.within('.mr-source-target') do
+          expect(page).not_to have_content(/([0-9]+ commit[s]? behind)/)
+        end
+      end
+    end
+
+    context 'when the branch is diverged on the target' do
+      let(:merge_request) { create(:merge_request, :diverged, source_project: project, target_project: project) }
+
+      before do
+        visit(merge_request_path(merge_request))
+      end
+
+      it 'shows diverged commits count' do
+        page.within('.mr-source-target') do
+          expect(page).to have_content(/([0-9]+ commits behind)/)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/features/projects/merge_requests/user_views_open_merge_requests_spec.rb b/spec/features/projects/merge_requests/user_views_open_merge_requests_spec.rb
new file mode 100644
index 00000000000..07b8c1ef479
--- /dev/null
+++ b/spec/features/projects/merge_requests/user_views_open_merge_requests_spec.rb
@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+describe 'User views open merge requests' do
+  let(:project) { create(:project, :public, :repository) }
+
+  context "when the target branch is the project's default branch" do
+    let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+    let!(:closed_merge_request) { create(:closed_merge_request, source_project: project, target_project: project) }
+
+    before do
+      visit(project_merge_requests_path(project))
+    end
+
+    it 'shows open merge requests' do
+      expect(page).to have_content(merge_request.title).and have_no_content(closed_merge_request.title)
+    end
+
+    it 'does not show target branch name' do
+      expect(page).to have_content(merge_request.title)
+      expect(find('.issuable-info')).not_to have_content(project.default_branch)
+    end
+  end
+
+  context "when the target branch is different from the project's default branch" do
+    let!(:merge_request) do
+      create(:merge_request,
+        source_project: project,
+        target_project: project,
+        source_branch: 'fix',
+        target_branch: 'feature_conflict')
+    end
+
+    before do
+      visit(project_merge_requests_path(project))
+    end
+
+    it 'shows target branch name' do
+      expect(page).to have_content(merge_request.target_branch)
+    end
+  end
+
+  context 'when a merge request has pipelines' do
+    let!(:build) { create :ci_build, pipeline: pipeline }
+
+    let(:merge_request) do
+      create(:merge_request_with_diffs,
+       source_project: project,
+       target_project: project,
+       source_branch: 'merge-test')
+    end
+
+    let(:pipeline) do
+      create(:ci_pipeline,
+        project: project,
+        sha: merge_request.diff_head_sha,
+        ref: merge_request.source_branch,
+        head_pipeline_of: merge_request)
+    end
+
+    before do
+      project.enable_ci
+
+      visit(project_merge_requests_path(project))
+    end
+
+    it 'shows pipeline status' do
+      page.within('.mr-list') do
+        expect(page).to have_link('Pipeline: pending')
+      end
+    end
+  end
+end
diff --git a/spec/support/helpers/merge_request_diff_helpers.rb b/spec/support/helpers/merge_request_diff_helpers.rb
new file mode 100644
index 00000000000..fd22e384b1b
--- /dev/null
+++ b/spec/support/helpers/merge_request_diff_helpers.rb
@@ -0,0 +1,28 @@
+module MergeRequestDiffHelpers
+  def click_diff_line(line_holder, diff_side = nil)
+    line = get_line_components(line_holder, diff_side)
+    line[:content].hover
+    line[:num].find('.add-diff-note').trigger('click')
+  end
+
+  def get_line_components(line_holder, diff_side = nil)
+    if diff_side.nil?
+      get_inline_line_components(line_holder)
+    else
+      get_parallel_line_components(line_holder, diff_side)
+    end
+  end
+
+  def get_inline_line_components(line_holder)
+    { content: line_holder.find('.line_content', match: :first), num: line_holder.find('.diff-line-num', match: :first) }
+  end
+
+  def get_parallel_line_components(line_holder, diff_side = nil)
+    side_index = diff_side == 'left' ? 0 : 1
+    # Wait for `.line_content`
+    line_holder.find('.line_content', match: :first)
+    # Wait for `.diff-line-num`
+    line_holder.find('.diff-line-num', match: :first)
+    { content: line_holder.all('.line_content')[side_index], num: line_holder.all('.diff-line-num')[side_index] }
+  end
+end
diff --git a/spec/support/shared_examples/features/comments_on_merge_request_files_shared_examples.rb b/spec/support/shared_examples/features/comments_on_merge_request_files_shared_examples.rb
new file mode 100644
index 00000000000..221926aaf7e
--- /dev/null
+++ b/spec/support/shared_examples/features/comments_on_merge_request_files_shared_examples.rb
@@ -0,0 +1,28 @@
+shared_examples 'comment on merge request file' do
+  it 'adds a comment' do
+    click_diff_line(find("[id='#{sample_commit.line_code}']"))
+
+    page.within('.js-discussion-note-form') do
+      fill_in(:note_note, with: 'Line is wrong')
+      click_button('Comment')
+    end
+
+    wait_for_requests
+
+    page.within('.notes_holder') do
+      expect(page).to have_content('Line is wrong')
+    end
+
+    visit(merge_request_path(merge_request))
+
+    page.within('.notes .discussion') do
+      expect(page).to have_content("#{user.name} #{user.to_reference} started a discussion")
+      expect(page).to have_content(sample_commit.line_code_path)
+      expect(page).to have_content('Line is wrong')
+    end
+
+    page.within('.notes-tab .badge') do
+      expect(page).to have_content('1')
+    end
+  end
+end
-- 
cgit v1.2.1


From 7d8e410ffea377f101bf26022ce2e3dd881adb02 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Wed, 4 Oct 2017 23:47:03 +0100
Subject: Changes after review

---
 app/assets/javascripts/clusters.js             |  7 +++--
 app/views/projects/clusters/_header.html.haml  | 27 +++++++++---------
 app/views/projects/clusters/_sidebar.html.haml | 15 +++++-----
 app/views/projects/clusters/login.html.haml    |  8 ++++--
 app/views/projects/clusters/new.html.haml      |  6 ++--
 app/views/projects/clusters/show.html.haml     |  9 +++---
 spec/javascripts/clusters_spec.js              | 38 +++++++++++++-------------
 7 files changed, 57 insertions(+), 53 deletions(-)

diff --git a/app/assets/javascripts/clusters.js b/app/assets/javascripts/clusters.js
index 8bd4de92e6f..50dbeb06362 100644
--- a/app/assets/javascripts/clusters.js
+++ b/app/assets/javascripts/clusters.js
@@ -39,6 +39,7 @@ export default class Clusters {
     this.errorContainer = document.querySelector('.js-cluster-error');
     this.successContainer = document.querySelector('.js-cluster-success');
     this.creatingContainer = document.querySelector('.js-cluster-creating');
+    this.errorReasonContainer = this.errorContainer.querySelector('.js-error-reason');
 
     this.toggleButton.addEventListener('click', this.toggle.bind(this));
 
@@ -47,7 +48,7 @@ export default class Clusters {
     }
 
     if (this.state.statusPath) {
-      this.initPoling();
+      this.initPolling();
     }
   }
 
@@ -56,7 +57,7 @@ export default class Clusters {
     this.toggleInput.setAttribute('value', this.toggleButton.classList.contains('checked').toString());
   }
 
-  initPoling() {
+  initPolling() {
     this.poll = new Poll({
       resource: this.service,
       method: 'fetchData',
@@ -98,7 +99,7 @@ export default class Clusters {
         break;
       case 'errored':
         this.errorContainer.classList.remove('hidden');
-        this.errorContainer.querySelector('.js-error-reason').textContent = error;
+        this.errorReasonContainer.textContent = error;
         break;
       case 'scheduled':
       case 'creating':
diff --git a/app/views/projects/clusters/_header.html.haml b/app/views/projects/clusters/_header.html.haml
index c7c5272089a..b3b98ea04f6 100644
--- a/app/views/projects/clusters/_header.html.haml
+++ b/app/views/projects/clusters/_header.html.haml
@@ -1,15 +1,14 @@
-.col-lg-8
-  %h4.prepend-top-0
-    = s_('ClusterIntegration|Create new cluster on Google Container Engine')
-  %p
-    = s_('ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:')
-  %ul
+%h4.prepend-top-0
+  = s_('ClusterIntegration|Create new cluster on Google Container Engine')
+%p
+  = s_('ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:')
+%ul
+  %li
+    - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'), 'https://console.cloud.google.com', target: '_blank', rel: 'noopener noreferrer')
+    = s_('ClusterIntegration|Your account must have %{link_to_container_engine}').html_safe % { link_to_container_engine: link_to_container_engine }
     %li
-      - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'), 'https://console.cloud.google.com', target: '_blank', rel: 'noopener noreferrer')
-      = s_('ClusterIntegration|Your account must have %{link_to_container_engine}').html_safe % { link_to_container_engine: link_to_container_engine }
-      %li
-        - link_to_requirements = link_to(s_('ClusterIntegration|meets the requirements'), 'https://cloud.google.com/container-engine/docs/quickstart', target: '_blank', rel: 'noopener noreferrer')
-        = s_('ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters').html_safe % { link_to_requirements: link_to_requirements }
-      %li
-        - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'), target: '_blank', rel: 'noopener noreferrer')
-        = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
+      - link_to_requirements = link_to(s_('ClusterIntegration|meets the requirements'), 'https://cloud.google.com/container-engine/docs/quickstart', target: '_blank', rel: 'noopener noreferrer')
+      = s_('ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters').html_safe % { link_to_requirements: link_to_requirements }
+    %li
+      - link_to_container_project = link_to(s_('ClusterIntegration|Google Container Engine project'), target: '_blank', rel: 'noopener noreferrer')
+      = s_('ClusterIntegration|A %{link_to_container_project} must have been created under this account').html_safe % { link_to_container_project: link_to_container_project }
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
index 739c38e073a..0d744f1b028 100644
--- a/app/views/projects/clusters/_sidebar.html.haml
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -1,8 +1,7 @@
-.col-sm-4
-  %h4.prepend-top-0
-    = s_('ClusterIntegration|Cluster integration')
-  %p
-    = s_('ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way.')
-  %p
-    - link = link_to(s_('ClusterIntegration|cluster'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
-    = s_('ClusterIntegration|Learn more about %{link_to_documentation}').html_safe % { link_to_documentation: link }
+%h4.prepend-top-0
+  = s_('ClusterIntegration|Cluster integration')
+%p
+  = s_('ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way.')
+%p
+  - link = link_to(s_('ClusterIntegration|cluster'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
+  = s_('ClusterIntegration|Learn more about %{link_to_documentation}').html_safe % { link_to_documentation: link }
diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
index 3c68d4dbabc..1492f6163e1 100644
--- a/app/views/projects/clusters/login.html.haml
+++ b/app/views/projects/clusters/login.html.haml
@@ -1,10 +1,12 @@
 .row.prepend-top-default
-  = render 'sidebar'
-  = render 'header'
+  .col-sm-4
+    = render 'sidebar'
+  .col-sm-8
+    = render 'header'
 .row
   .col-sm-8.col-sm-offset-4
     - if @authorize_url
-      %a{ href: @authorize_url }
+      = link_to @authorize_url do
         = image_tag('auth_buttons/signin_with_google.png')
     - else
       - link = link_to(s_('ClusterIntegration|properly configured'), help_page_path("integration/google"), target: '_blank', rel: 'noopener noreferrer')
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index e1ff4c6136e..4b7214b3c62 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -1,4 +1,6 @@
 .row.prepend-top-default
-  = render 'sidebar'
-  = render 'header'
+  .col-sm-4
+    = render 'sidebar'
+  .col-sm-8
+    = render 'header'
 = render 'form'
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index ecf43981c49..f3124acfa1c 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -3,8 +3,9 @@
   toggle_status: @cluster.enabled? ? 'true': 'false',
   cluster_status: @cluster.status_name,
   cluster_status_reason: @cluster.status_reason }}
-  = render 'sidebar'
-  .col-lg-8
+  .col-sm-4
+    = render 'sidebar'
+  .col-sm-8
     %h4.prepend-top-0
       = s_('ClusterIntegration|Enable cluster integration')
     %p
@@ -24,7 +25,7 @@
 
           %button{ type: 'button',
             class: "js-toggle-cluster project-feature-toggle #{'checked' unless !@cluster.enabled?} #{'disabled' unless can?(current_user, :update_cluster, @cluster)}",
-            'aria-label': 'Toggle',
+            'aria-label': s_('ClusterIntegration|Toggle Cluster'),
             disabled: !can?(current_user, :update_cluster, @cluster),
             data: { 'enabled-text': 'Enabled', 'disabled-text': 'Disabled' } }
 
@@ -50,7 +51,7 @@
         = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
 
     .form_group
-      %label
+      %label{ for: 'cluter_name' }
         = s_('ClusterIntegration|Cluster name')
       .input-group
         %input.form-control{ value: @cluster.gcp_cluster_name, disabled: true}
diff --git a/spec/javascripts/clusters_spec.js b/spec/javascripts/clusters_spec.js
index 2ceb0cfdf4c..eb1cd6eb804 100644
--- a/spec/javascripts/clusters_spec.js
+++ b/spec/javascripts/clusters_spec.js
@@ -29,14 +29,14 @@ describe('Clusters', () => {
         cluster.updateContainer('creating');
 
         expect(
-          cluster.creatingContainer.classList,
-        ).not.toContain('hidden');
+          cluster.creatingContainer.classList.contains('hidden'),
+        ).toBeFalsy();
         expect(
-          cluster.successContainer.classList,
-        ).toContain('hidden');
+          cluster.successContainer.classList.contains('hidden'),
+        ).toBeTruthy();
         expect(
-          cluster.errorContainer.classList,
-        ).toContain('hidden');
+          cluster.errorContainer.classList.contains('hidden'),
+        ).toBeTruthy();
       });
     });
 
@@ -45,14 +45,14 @@ describe('Clusters', () => {
         cluster.updateContainer('created');
 
         expect(
-          cluster.creatingContainer.classList,
-        ).toContain('hidden');
+          cluster.creatingContainer.classList.contains('hidden'),
+        ).toBeTruthy();
         expect(
-          cluster.successContainer.classList,
-        ).not.toContain('hidden');
+          cluster.successContainer.classList.contains('hidden'),
+        ).toBeFalsy();
         expect(
-          cluster.errorContainer.classList,
-        ).toContain('hidden');
+          cluster.errorContainer.classList.contains('hidden'),
+        ).toBeTruthy();
       });
     });
 
@@ -61,17 +61,17 @@ describe('Clusters', () => {
         cluster.updateContainer('errored', 'this is an error');
 
         expect(
-          cluster.creatingContainer.classList,
-        ).toContain('hidden');
+          cluster.creatingContainer.classList.contains('hidden'),
+        ).toBeTruthy();
         expect(
-          cluster.successContainer.classList,
-        ).toContain('hidden');
+          cluster.successContainer.classList.contains('hidden'),
+        ).toBeTruthy();
         expect(
-          cluster.errorContainer.classList,
-        ).not.toContain('hidden');
+          cluster.errorContainer.classList.contains('hidden'),
+        ).toBeFalsy();
 
         expect(
-          cluster.errorContainer.querySelector('.js-error-reason').textContent,
+          cluster.errorReasonContainer.textContent,
         ).toContain('this is an error');
       });
     });
-- 
cgit v1.2.1


From d6e22e83d1fe8ffaa71c3bcb7906731733a89f0e Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Thu, 5 Oct 2017 00:01:55 +0100
Subject: Adds i18n pot file

---
 locale/gitlab.pot | 142 +++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 131 insertions(+), 11 deletions(-)

diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 53e37c53377..74e59294f08 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -8,8 +8,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gitlab 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2017-09-28 13:28-0400\n"
-"PO-Revision-Date: 2017-09-28 13:28-0400\n"
+"POT-Creation-Date: 2017-10-04 23:47+0100\n"
+"PO-Revision-Date: 2017-10-04 23:47+0100\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -367,6 +367,129 @@ msgstr ""
 msgid "Clone repository"
 msgstr ""
 
+msgid "ClusterIntegration|A %{link_to_container_project} must have been created under this account"
+msgstr ""
+
+msgid "ClusterIntegration|Cluster integration"
+msgstr ""
+
+msgid "ClusterIntegration|Cluster integration is disabled for this project."
+msgstr ""
+
+msgid "ClusterIntegration|Cluster integration is enabled for this project."
+msgstr ""
+
+msgid "ClusterIntegration|Cluster integration is enabled for this project. Disabling this integration will not affect your cluster, it will only temporarily turn off GitLab's connection to it."
+msgstr ""
+
+msgid "ClusterIntegration|Cluster is being created on Google Container Engine..."
+msgstr ""
+
+msgid "ClusterIntegration|Cluster name"
+msgstr ""
+
+msgid "ClusterIntegration|Cluster was successfully created on Google Container Engine."
+msgstr ""
+
+msgid "ClusterIntegration|Copy cluster name"
+msgstr ""
+
+msgid "ClusterIntegration|Create cluster"
+msgstr ""
+
+msgid "ClusterIntegration|Create new cluster on Google Container Engine"
+msgstr ""
+
+msgid "ClusterIntegration|Enable cluster integration"
+msgstr ""
+
+msgid "ClusterIntegration|Google Cloud Platform project ID"
+msgstr ""
+
+msgid "ClusterIntegration|Google Container Engine"
+msgstr ""
+
+msgid "ClusterIntegration|Google Container Engine project"
+msgstr ""
+
+msgid "ClusterIntegration|Google container engine"
+msgstr ""
+
+msgid "ClusterIntegration|Learn more about %{link_to_documentation}"
+msgstr ""
+
+msgid "ClusterIntegration|Machine type"
+msgstr ""
+
+msgid "ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters"
+msgstr ""
+
+msgid "ClusterIntegration|Manage your cluster by visiting %{link_gke}"
+msgstr ""
+
+msgid "ClusterIntegration|Number of nodes"
+msgstr ""
+
+msgid "ClusterIntegration|Project namespace (optional, unique)"
+msgstr ""
+
+msgid "ClusterIntegration|Remove cluster integration"
+msgstr ""
+
+msgid "ClusterIntegration|Remove integration"
+msgstr ""
+
+msgid "ClusterIntegration|Removing cluster integration will remove the cluster configuration you have added to this project. It will not delete your project."
+msgstr ""
+
+msgid "ClusterIntegration|Save changes"
+msgstr ""
+
+msgid "ClusterIntegration|See your projects"
+msgstr ""
+
+msgid "ClusterIntegration|See zones"
+msgstr ""
+
+msgid "ClusterIntegration|Something went wrong on our end."
+msgstr ""
+
+msgid "ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine."
+msgstr ""
+
+msgid "ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:"
+msgstr ""
+
+msgid "ClusterIntegration|Toggle Cluster"
+msgstr ""
+
+msgid "ClusterIntegration|Use our %{link_to_help_page} on cluster integration."
+msgstr ""
+
+msgid "ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way."
+msgstr ""
+
+msgid "ClusterIntegration|Your account must have %{link_to_container_engine}"
+msgstr ""
+
+msgid "ClusterIntegration|Zone"
+msgstr ""
+
+msgid "ClusterIntegration|access to Google Container Engine"
+msgstr ""
+
+msgid "ClusterIntegration|cluster"
+msgstr ""
+
+msgid "ClusterIntegration|help page"
+msgstr ""
+
+msgid "ClusterIntegration|meets the requirements"
+msgstr ""
+
+msgid "ClusterIntegration|properly configured"
+msgstr ""
+
 msgid "Comments"
 msgstr ""
 
@@ -420,9 +543,6 @@ msgstr ""
 msgid "Create New Directory"
 msgstr ""
 
-msgid "Create a new branch"
-msgstr ""
-
 msgid "Create a personal access token on your account to pull or push via %{protocol}."
 msgstr ""
 
@@ -643,6 +763,9 @@ msgstr ""
 msgid "GoToYourFork|Fork"
 msgstr ""
 
+msgid "Google authentication is not %{link_to_documentation}. Ask your GitLab administrator if you want to use this service."
+msgstr ""
+
 msgid "GroupSettings|Prevent sharing a project within %{group} with other groups"
 msgstr ""
 
@@ -1189,9 +1312,6 @@ msgstr ""
 msgid "Select a timezone"
 msgstr ""
 
-msgid "Select existing branch"
-msgstr ""
-
 msgid "Select target branch"
 msgstr ""
 
@@ -1493,9 +1613,6 @@ msgstr ""
 msgid "Timeago|a week ago"
 msgstr ""
 
-msgid "Timeago|a while"
-msgstr ""
-
 msgid "Timeago|a year ago"
 msgstr ""
 
@@ -1547,6 +1664,9 @@ msgstr ""
 msgid "Timeago|in 1 year"
 msgstr ""
 
+msgid "Timeago|in a while"
+msgstr ""
+
 msgid "Timeago|less than a minute ago"
 msgstr ""
 
-- 
cgit v1.2.1


From 6b07aa5ec863706e58f781ee77ad54b54702c88a Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 16:34:24 +0900
Subject: integrate_cluster_service_spec. provision_cluster_service_spec.
 update_cluster_service_spec.

---
 app/models/gcp/cluster.rb                          |  2 +-
 app/services/ci/integrate_cluster_service.rb       |  2 +-
 spec/factories/gcp/cluster.rb                      | 11 ++-
 spec/services/ci/integrate_cluster_service_spec.rb | 29 +++++++-
 spec/services/ci/provision_cluster_service_spec.rb | 78 ++++++++++++++++++++--
 spec/services/ci/update_cluster_service_spec.rb    | 30 +++++++--
 6 files changed, 137 insertions(+), 15 deletions(-)

diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index fceda191880..0e8b920741d 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -97,7 +97,7 @@ module Gcp
     end
 
     def api_url
-      'https://' + endpoint
+      'https://' + endpoint if endpoint
     end
 
     def restrict_modification
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index 857bca3f953..d123ce8d26b 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -20,7 +20,7 @@ module Ci
           token: token)
       end
     rescue ActiveRecord::RecordInvalid => e
-      cluster.error!("Failed to integrate cluster into kubernetes_service: #{e.message}")
+      cluster.make_errored!("Failed to integrate cluster into kubernetes_service: #{e.message}")
     end
   end
 end
diff --git a/spec/factories/gcp/cluster.rb b/spec/factories/gcp/cluster.rb
index 2f98d024084..630e40da888 100644
--- a/spec/factories/gcp/cluster.rb
+++ b/spec/factories/gcp/cluster.rb
@@ -7,9 +7,18 @@ FactoryGirl.define do
     gcp_cluster_name 'test-cluster'
     gcp_cluster_zone 'us-central1-a'
     gcp_cluster_size 1
+    gcp_machine_type 'n1-standard-4'
 
     trait :with_kubernetes_service do
-      service :kubernetes_service
+      after(:create) do |cluster, evaluator|
+        create(:kubernetes_service, project: cluster.project).tap do |service|
+          cluster.update(service: service)
+        end
+      end
+    end
+
+    trait :custom_project_namespace do
+      project_namespace 'sample-app'
     end
 
     trait :created_on_gke do
diff --git a/spec/services/ci/integrate_cluster_service_spec.rb b/spec/services/ci/integrate_cluster_service_spec.rb
index 7a8c80ca4e7..3a79c205bd1 100644
--- a/spec/services/ci/integrate_cluster_service_spec.rb
+++ b/spec/services/ci/integrate_cluster_service_spec.rb
@@ -2,15 +2,40 @@ require 'spec_helper'
 
 describe Ci::IntegrateClusterService do
   describe '#execute' do
+    let(:cluster) { create(:gcp_cluster, :custom_project_namespace) }
+    let(:endpoint) { '123.123.123.123' }
+    let(:ca_cert) { 'ca_cert_xxx' }
+    let(:token) { 'token_xxx' }
+    let(:username) { 'username_xxx' }
+    let(:password) { 'password_xxx' }
+
+    before do
+      described_class
+        .new.execute(cluster, endpoint, ca_cert, token, username, password)
+
+      cluster.reload
+    end
+
     context 'when correct params' do
       it 'creates a cluster object' do
-        
+        expect(cluster.endpoint).to eq(endpoint)
+        expect(cluster.ca_cert).to eq(ca_cert)
+        expect(cluster.kubernetes_token).to eq(token)
+        expect(cluster.username).to eq(username)
+        expect(cluster.password).to eq(password)
+        expect(cluster.service.active).to be_truthy
+        expect(cluster.service.api_url).to eq(cluster.api_url)
+        expect(cluster.service.ca_pem).to eq(ca_cert)
+        expect(cluster.service.namespace).to eq(cluster.project_namespace)
+        expect(cluster.service.token).to eq(token)
       end
     end
 
     context 'when invalid params' do
-      it 'returns a cluster object with error' do
+      let(:endpoint) { nil }
 
+      it 'sets an error to cluster object' do
+        expect(cluster).to be_errored
       end
     end
   end
diff --git a/spec/services/ci/provision_cluster_service_spec.rb b/spec/services/ci/provision_cluster_service_spec.rb
index d1595c8917d..5ce5c788314 100644
--- a/spec/services/ci/provision_cluster_service_spec.rb
+++ b/spec/services/ci/provision_cluster_service_spec.rb
@@ -2,16 +2,84 @@ require 'spec_helper'
 
 describe Ci::ProvisionClusterService do
   describe '#execute' do
-    context 'when correct params' do
-      it 'creates a cluster on gke' do
-        
+    let(:cluster) { create(:gcp_cluster) }
+    let(:operation) { spy }
+
+    shared_examples 'error' do
+      it 'sets an error to cluster object' do
+        described_class.new.execute(cluster)
+
+        expect(cluster.reload).to be_errored
       end
     end
 
-    context 'when invalid params' do
-      it 'returns a cluster object with error' do
+    context 'when suceeded to request provision' do
+      before do
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_clusters_create).and_return(operation)
+      end
+
+      context 'when operation status is RUNNING' do
+        before do
+          allow(operation).to receive(:status).and_return('RUNNING')
+        end
+
+        context 'when suceeded to parse gcp operation id' do
+          before do
+            allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+              .to receive(:parse_operation_id).and_return('operation-123')
+          end
+
+          context 'when cluster status is scheduled' do
+            before do
+              allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+                .to receive(:parse_operation_id).and_return('operation-123')
+            end
+
+            it 'schedules a worker for status minitoring' do
+              expect(WaitForClusterCreationWorker).to receive(:perform_in)
+
+              described_class.new.execute(cluster)
+            end
+          end
+
+          context 'when cluster status is creating' do
+            before do
+              cluster.make_creating!
+            end
+
+            it_behaves_like 'error'
+          end
+        end
 
+        context 'when failed to parse gcp operation id' do
+          before do
+            allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+              .to receive(:parse_operation_id).and_return(nil)
+          end
+
+          it_behaves_like 'error'
+        end
       end
+
+      context 'when operation status is others' do
+        before do
+          allow(operation).to receive(:status).and_return('others')
+        end
+
+        it_behaves_like 'error'
+      end
+    end
+
+    context 'when failed to request provision' do
+      let(:error) { Google::Apis::ServerError.new('a') }
+
+      before do
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_clusters_create).and_raise(error)
+      end
+
+      it_behaves_like 'error'
     end
   end
 end
diff --git a/spec/services/ci/update_cluster_service_spec.rb b/spec/services/ci/update_cluster_service_spec.rb
index afe3d418a8e..a289385b88f 100644
--- a/spec/services/ci/update_cluster_service_spec.rb
+++ b/spec/services/ci/update_cluster_service_spec.rb
@@ -2,15 +2,35 @@ require 'spec_helper'
 
 describe Ci::UpdateClusterService do
   describe '#execute' do
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, :with_kubernetes_service) }
+
+    before do
+      described_class.new(cluster.project, cluster.user, params).execute(cluster)
+
+      cluster.reload
+    end
+
     context 'when correct params' do
-      it 'updates the cluster and the service' do
-        
+      context 'when enabled is true' do
+        let(:params) { { 'enabled' => 'true' } }
+
+        it 'enables cluster and overwrite kubernetes service' do
+          expect(cluster.enabled).to be_truthy
+          expect(cluster.service.active).to be_truthy
+          expect(cluster.service.api_url).to eq(cluster.api_url)
+          expect(cluster.service.ca_pem).to eq(cluster.ca_cert)
+          expect(cluster.service.namespace).to eq(cluster.project_namespace)
+          expect(cluster.service.token).to eq(cluster.kubernetes_token)
+        end
       end
-    end
 
-    context 'when invalid params' do
-      it 'returns a cluster object with error' do
+      context 'when enabled is false' do
+        let(:params) { { 'enabled' => 'false' } }
 
+        it 'disables cluster and kubernetes service' do
+          expect(cluster.enabled).to be_falsy
+          expect(cluster.service.active).to be_falsy
+        end
       end
     end
   end
-- 
cgit v1.2.1


From 31c89258821b680da18fc02439b1be4471846571 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 18:17:21 +0900
Subject: spec/lib/google_api/auth_spec.
 spec/lib/google_api/cloud_platform/client_spec

---
 lib/google_api/cloud_platform/client.rb           |   3 +-
 spec/lib/google_api/auth_spec.rb                  |  41 ++++++++
 spec/lib/google_api/cloud_platform/client_spec.rb | 111 ++++++++++++++++++++++
 3 files changed, 154 insertions(+), 1 deletion(-)
 create mode 100644 spec/lib/google_api/auth_spec.rb
 create mode 100644 spec/lib/google_api/cloud_platform/client_spec.rb

diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index d13e3290cf5..926b7402cd5 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -65,7 +65,8 @@ module GoogleApi
       end
 
       def parse_operation_id(self_link)
-        self_link.match(%r{projects/.*/zones/.*/operations/(.*)})[1]
+        m = self_link.match(%r{projects/.*/zones/.*/operations/(.*)})
+        m[1] if m
       end
     end
   end
diff --git a/spec/lib/google_api/auth_spec.rb b/spec/lib/google_api/auth_spec.rb
new file mode 100644
index 00000000000..87a3f43274f
--- /dev/null
+++ b/spec/lib/google_api/auth_spec.rb
@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe GoogleApi::Auth do
+  let(:redirect_uri) { 'http://localhost:3000/google_api/authorizations/callback' }
+  let(:redirect_to) { 'http://localhost:3000/namaspace/project/clusters' }
+
+  let(:client) do
+    GoogleApi::CloudPlatform::Client
+      .new(nil, redirect_uri, state: redirect_to)
+  end
+
+  describe '#authorize_url' do
+    subject { client.authorize_url }
+
+    it 'returns authorize_url' do
+      is_expected.to start_with('https://accounts.google.com/o/oauth2')
+      is_expected.to include(URI.encode(redirect_uri, URI::PATTERN::RESERVED))
+      is_expected.to include(URI.encode(redirect_to, URI::PATTERN::RESERVED))
+    end
+  end
+
+  describe '#get_token' do
+    let(:token) do
+      double.tap do |dbl|
+        allow(dbl).to receive(:token).and_return('token')
+        allow(dbl).to receive(:expires_at).and_return('expires_at')
+      end
+    end
+
+    before do
+      allow_any_instance_of(OAuth2::Strategy::AuthCode)
+        .to receive(:get_token).and_return(token)
+    end
+
+    it 'returns token and expires_at' do
+      token, expires_at = client.get_token('xxx')
+      expect(token).to eq('token')
+      expect(expires_at).to eq('expires_at')
+    end
+  end
+end
diff --git a/spec/lib/google_api/cloud_platform/client_spec.rb b/spec/lib/google_api/cloud_platform/client_spec.rb
new file mode 100644
index 00000000000..6b454a593a0
--- /dev/null
+++ b/spec/lib/google_api/cloud_platform/client_spec.rb
@@ -0,0 +1,111 @@
+require 'spec_helper'
+
+describe GoogleApi::CloudPlatform::Client do
+  let(:token) { 'token' }
+  let(:client) { described_class.new(token, nil) }
+
+  describe '#validate_token' do
+    subject { client.validate_token(expires_at) }
+
+    let(:expires_at) { 1.hour.since.strftime('%s') }
+
+    context 'when token is nil' do
+      let(:token) { nil }
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'when expires_at is nil' do
+      let(:expires_at) { nil }
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'when expires in 1 hour' do
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when expires in 10 minutes' do
+      let(:expires_at) { 5.minutes.since.strftime('%s') }
+
+      it { is_expected.to be_falsy }
+    end
+  end
+
+  describe '#projects_zones_clusters_get' do
+    subject { client.projects_zones_clusters_get(spy, spy, spy) }
+    let(:gke_cluster) { double }
+
+    before do
+      allow_any_instance_of(Google::Apis::ContainerV1::ContainerService)
+        .to receive(:get_zone_cluster).and_return(gke_cluster)
+    end
+
+    it { is_expected.to eq(gke_cluster) }
+  end
+
+  describe '#projects_zones_clusters_create' do
+    subject do
+      client.projects_zones_clusters_create(
+        spy, spy, cluster_name, cluster_size, machine_type: machine_type)
+    end
+
+    let(:cluster_name) { 'test-cluster' }
+    let(:cluster_size) { 1 }
+    let(:machine_type) { 'n1-standard-4' }
+    let(:operation) { double }
+
+    before do
+      allow_any_instance_of(Google::Apis::ContainerV1::ContainerService)
+        .to receive(:create_cluster).and_return(operation)
+    end
+
+    it { is_expected.to eq(operation) }
+
+    it 'sets corresponded parameters' do
+      expect_any_instance_of(Google::Apis::ContainerV1::CreateClusterRequest)
+        .to receive(:initialize).with(
+          {
+            "cluster": {
+              "name": cluster_name,
+              "initial_node_count": cluster_size,
+              "node_config": {
+                "machine_type": machine_type
+              }
+            }
+          } )
+
+      subject
+    end
+  end
+
+  describe '#projects_zones_operations' do
+    subject { client.projects_zones_operations(spy, spy, spy) }
+    let(:operation) { double }
+
+    before do
+      allow_any_instance_of(Google::Apis::ContainerV1::ContainerService)
+        .to receive(:get_zone_operation).and_return(operation)
+    end
+
+    it { is_expected.to eq(operation) }
+  end
+
+  describe '#parse_operation_id' do
+    subject { client.parse_operation_id(self_link) }
+
+    context 'when expected url' do
+      let(:self_link) do
+        'projects/gcp-project-12345/zones/us-central1-a/operations/ope-123'
+      end
+
+      it { is_expected.to eq('ope-123') }
+    end
+
+    context 'when unexpected url' do
+      let(:self_link) { '???' }
+
+      it { is_expected.to be_nil }
+    end
+  end
+end
-- 
cgit v1.2.1


From 8b16f1074ddb6ea6a5404d37409ab81002f28d52 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Thu, 5 Oct 2017 11:54:46 +0200
Subject: Refactored Highlighting mechanism

---
 app/assets/javascripts/line_highlighter.js              |  9 ++++++---
 app/assets/javascripts/repo/components/repo_editor.vue  | 14 +++++++++-----
 app/assets/javascripts/repo/components/repo_preview.vue |  3 +++
 app/assets/javascripts/repo/components/repo_sidebar.vue |  8 --------
 4 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/app/assets/javascripts/line_highlighter.js b/app/assets/javascripts/line_highlighter.js
index a16d00b5cef..9999b5a200c 100644
--- a/app/assets/javascripts/line_highlighter.js
+++ b/app/assets/javascripts/line_highlighter.js
@@ -54,12 +54,14 @@ LineHighlighter.prototype.bindEvents = function() {
   $fileHolder.on('highlight:line', this.highlightHash);
 };
 
-LineHighlighter.prototype.highlightHash = function() {
-  var range;
+LineHighlighter.prototype.highlightHash = function(newHash) {
+  let range;
+  if (newHash) this._hash = newHash;
+
+  this.clearHighlight();
 
   if (this._hash !== '') {
     range = this.hashToRange(this._hash);
-
     if (range[0]) {
       this.highlightRange(range);
       const lineSelector = `#L${range[0]}`;
@@ -131,6 +133,7 @@ LineHighlighter.prototype.hashToRange = function(hash) {
 //
 // lineNumber - Line number to highlight
 LineHighlighter.prototype.highlightLine = function(lineNumber) {
+  console.log('LINE : ' + lineNumber);
   return $("#LC" + lineNumber).addClass(this.highlightLineClass);
 };
 
diff --git a/app/assets/javascripts/repo/components/repo_editor.vue b/app/assets/javascripts/repo/components/repo_editor.vue
index f1acd339ad3..02d9c775046 100644
--- a/app/assets/javascripts/repo/components/repo_editor.vue
+++ b/app/assets/javascripts/repo/components/repo_editor.vue
@@ -64,11 +64,6 @@ const RepoEditor = {
       if (e.target.element.classList.contains('line-numbers')) {
         location.hash = `L${lineNumber}`;
         Store.setActiveLine(lineNumber);
-
-        Helper.monacoInstance.setPosition({
-          lineNumber: this.activeLine,
-          column: 1,
-        });
       }
     },
   },
@@ -101,6 +96,15 @@ const RepoEditor = {
         this.setupEditor();
       }
     },
+
+    activeLine() {
+      if (Helper.monacoInstance) {
+        Helper.monacoInstance.setPosition({
+          lineNumber: this.activeLine,
+          column: 1,
+        });
+      }
+    },
   },
   computed: {
     shouldHideEditor() {
diff --git a/app/assets/javascripts/repo/components/repo_preview.vue b/app/assets/javascripts/repo/components/repo_preview.vue
index 2fe369a4693..514c7d9284c 100644
--- a/app/assets/javascripts/repo/components/repo_preview.vue
+++ b/app/assets/javascripts/repo/components/repo_preview.vue
@@ -28,6 +28,9 @@ export default {
         this.highlightFile();
       });
     },
+    activeLine(e) {
+      this.lineHighlighter.highlightHash('#L' + Store.activeLine);
+    },
   },
 };
 </script>
diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 9f58f63b850..2b0f1f661ff 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -42,14 +42,6 @@ export default {
           const lineNumber = Number(location.hash.substr(2));
           if (!isNaN(lineNumber)) {
             Store.setActiveLine(lineNumber);
-            if (Store.isPreviewView() && document.getElementById(`L${lineNumber}`)) {
-              document.getElementById(`L${lineNumber}`).scrollIntoView();
-            } else {
-              Helper.monacoInstance.setPosition({
-                lineNumber: this.activeLine,
-                column: 1,
-              });
-            }
           }
         }
       } else {
-- 
cgit v1.2.1


From 8cd4a7cfd702ffce4630b48a3c266e0954087362 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Thu, 5 Oct 2017 12:01:37 +0200
Subject: Removed the console.log

---
 app/assets/javascripts/line_highlighter.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/assets/javascripts/line_highlighter.js b/app/assets/javascripts/line_highlighter.js
index 9999b5a200c..ef91d471639 100644
--- a/app/assets/javascripts/line_highlighter.js
+++ b/app/assets/javascripts/line_highlighter.js
@@ -133,7 +133,6 @@ LineHighlighter.prototype.hashToRange = function(hash) {
 //
 // lineNumber - Line number to highlight
 LineHighlighter.prototype.highlightLine = function(lineNumber) {
-  console.log('LINE : ' + lineNumber);
   return $("#LC" + lineNumber).addClass(this.highlightLineClass);
 };
 
-- 
cgit v1.2.1


From 8262cb2f4e9f366e99592859d6348f48da4a4d39 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Thu, 5 Oct 2017 12:29:31 +0200
Subject: CHanged to Helper Method

---
 app/assets/javascripts/repo/components/repo_sidebar.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 2b0f1f661ff..99bf471b83d 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -31,7 +31,7 @@ export default {
       let selectedFile = this.files.find(file => location.pathname.indexOf(file.url) > -1);
       if (!selectedFile) {
         // Maybe it is not in the current tree but in the opened tabs
-        selectedFile = Store.openedFiles.find(file => location.pathname.indexOf(file.url) > -1);
+        selectedFile = Helper.getFileFromPath(location.pathname);
       }
       if (selectedFile) {
         if (selectedFile.url !== this.activeFile.url) {
-- 
cgit v1.2.1


From b229637b0837065a9993d06573b41218ab7e9dfb Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 20:26:07 +0900
Subject: fetch_kubernetes_token_service_spec. Fix static analysys.

---
 app/services/ci/fetch_kubernetes_token_service.rb  |  2 +
 spec/lib/gitlab/usage_data_spec.rb                 |  1 +
 spec/models/gcp/cluster_spec.rb                    |  4 +-
 .../ci/fetch_kubernetes_token_service_spec.rb      | 59 +++++++++++++++++++---
 4 files changed, 58 insertions(+), 8 deletions(-)

diff --git a/app/services/ci/fetch_kubernetes_token_service.rb b/app/services/ci/fetch_kubernetes_token_service.rb
index 013e4f12682..44da87cb00c 100644
--- a/app/services/ci/fetch_kubernetes_token_service.rb
+++ b/app/services/ci/fetch_kubernetes_token_service.rb
@@ -22,6 +22,8 @@ module Ci
           return Base64.decode64(token_base64) if token_base64
         end
       end
+
+      nil
     end
 
     private
diff --git a/spec/lib/gitlab/usage_data_spec.rb b/spec/lib/gitlab/usage_data_spec.rb
index ee152872acc..777e9c8e21d 100644
--- a/spec/lib/gitlab/usage_data_spec.rb
+++ b/spec/lib/gitlab/usage_data_spec.rb
@@ -60,6 +60,7 @@ describe Gitlab::UsageData do
         deploy_keys
         deployments
         environments
+        gcp_clusters
         in_review_folder
         groups
         issues
diff --git a/spec/models/gcp/cluster_spec.rb b/spec/models/gcp/cluster_spec.rb
index 4b227a19bc2..350fbc257d9 100644
--- a/spec/models/gcp/cluster_spec.rb
+++ b/spec/models/gcp/cluster_spec.rb
@@ -122,12 +122,12 @@ describe Gcp::Cluster do
       let(:cluster) { create(:gcp_cluster) }
 
       before do
-        cluster.creating!
+        cluster.make_creating!
       end
 
       context 'when created' do
         before do
-          cluster.created!
+          cluster.make_created!
         end
 
         it { is_expected.to be_truthy }
diff --git a/spec/services/ci/fetch_kubernetes_token_service_spec.rb b/spec/services/ci/fetch_kubernetes_token_service_spec.rb
index b66b5a7947d..1d05c9671a9 100644
--- a/spec/services/ci/fetch_kubernetes_token_service_spec.rb
+++ b/spec/services/ci/fetch_kubernetes_token_service_spec.rb
@@ -2,16 +2,63 @@ require 'spec_helper'
 
 describe Ci::FetchKubernetesTokenService do
   describe '#execute' do
-    context 'when correct params' do
-      it 'fetch the kubernetes token' do
-        
+    subject { described_class.new(api_url, ca_pem, username, password).execute }
+
+    let(:api_url) { 'http://111.111.111.111' }
+    let(:ca_pem) { '' }
+    let(:username) { 'admin' }
+    let(:password) { 'xxx' }
+
+    context 'when params correct' do
+      let(:token) { 'xxx.token.xxx' }
+
+      let(:secrets_json) do
+        [
+          {
+            'metadata': {
+              name: metadata_name
+            },
+            'data': {
+              'token': Base64.encode64(token)
+            }
+          }
+        ]
+      end
+
+      before do
+        allow_any_instance_of(Kubeclient::Client)
+          .to receive(:get_secrets).and_return(secrets_json)
+      end
+
+      context 'when default-token exists' do
+        let(:metadata_name) { 'default-token-123' }
+
+        it { is_expected.to eq(token) }
       end
-    end
 
-    context 'when invalid params' do
-      it 'returns nil' do
+      context 'when default-token does not exist' do
+        let(:metadata_name) { 'another-token-123' }
 
+        it { is_expected.to be_nil }
       end
     end
+
+    context 'when api_url is nil' do
+      let(:api_url) { nil }
+
+      it { expect { subject }.to raise_error("Incomplete settings") }
+    end
+
+    context 'when username is nil' do
+      let(:username) { nil }
+
+      it { expect { subject }.to raise_error("Incomplete settings") }
+    end
+
+    context 'when password is nil' do
+      let(:password) { nil }
+
+      it { expect { subject }.to raise_error("Incomplete settings") }
+    end
   end
 end
-- 
cgit v1.2.1


From fe135fac68fab5e2a15e7aaa250ae91cd7fa4851 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 21:29:22 +0900
Subject: authorizations_controller_spec. cluster_policy_spec.

---
 .../google_api/authorizations_controller.rb        |  4 +-
 .../google_api/authorizations_controller_spec.rb   | 43 ++++++++++++++++++++++
 spec/policies/gcp/cluster_policy_spec.rb           | 28 ++++++++++++++
 3 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 spec/controllers/google_api/authorizations_controller_spec.rb
 create mode 100644 spec/policies/gcp/cluster_policy_spec.rb

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 890b4ce60c8..79f49d598af 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -9,10 +9,10 @@ module GoogleApi
       session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] =
         expires_at.to_s
 
-      if params[:state]
+      if params[:state].present?
         redirect_to params[:state]
       else
-        redirect_to root_url
+        redirect_to root_path
       end
     end
   end
diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
new file mode 100644
index 00000000000..53d584d167c
--- /dev/null
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -0,0 +1,43 @@
+require 'spec_helper'
+
+describe GoogleApi::AuthorizationsController do
+  describe 'GET|POST #callback' do
+    let(:user) { create(:user) }
+    let(:project) { create(:project) }
+    let(:state) { namespace_project_clusters_url(project.namespace, project).to_s }
+    let(:token) { 'token' }
+    let(:expires_at) { 1.hour.since.strftime('%s') }
+
+    subject { get :callback, code: 'xxx', state: state }
+
+    before do
+      sign_in(user)
+
+      allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+        .to receive(:get_token).and_return([token, expires_at])
+    end
+
+    it 'sets token and expires_atin session' do
+      subject
+
+      expect(session[GoogleApi::CloudPlatform::Client.session_key_for_token])
+        .to eq(token)
+      expect(session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at])
+        .to eq(expires_at)
+    end
+
+    context 'when redirection url is stored in state' do
+      it 'redirects to the URL stored in state param' do
+        expect(subject).to redirect_to(state)
+      end
+    end
+
+    context 'when redirection url is not stored in state' do
+      let(:state) { '' }
+
+      it 'redirects to root_path' do
+        expect(subject).to redirect_to(root_path)
+      end
+    end
+  end
+end
diff --git a/spec/policies/gcp/cluster_policy_spec.rb b/spec/policies/gcp/cluster_policy_spec.rb
new file mode 100644
index 00000000000..e213aa3d557
--- /dev/null
+++ b/spec/policies/gcp/cluster_policy_spec.rb
@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe Gcp::ClusterPolicy, :models do
+  set(:project) { create(:project) }
+  set(:cluster) { create(:gcp_cluster, project: project) }
+  let(:user) { create(:user) }
+  let(:policy) { described_class.new(user, cluster) }
+
+  describe 'rules' do
+    context 'when developer' do
+      before do
+        project.add_developer(user)
+      end
+
+      it { expect(policy).to be_disallowed :update_cluster }
+      it { expect(policy).to be_disallowed :admin_cluster }
+    end
+
+    context 'when master' do
+      before do
+        project.add_master(user)
+      end
+
+      it { expect(policy).to be_allowed :update_cluster }
+      it { expect(policy).to be_allowed :admin_cluster }
+    end
+  end
+end
-- 
cgit v1.2.1


From 19d8603d55ab47f0be7e209d6eeb87a632bb6fe1 Mon Sep 17 00:00:00 2001
From: Phil Hughes <me@iamphill.com>
Date: Thu, 5 Oct 2017 14:12:23 +0100
Subject: Fixed the navbar title hover style being applied outside the navbar

---
 app/assets/stylesheets/framework/gitlab-theme.scss    | 2 +-
 changelogs/unreleased/content-title-link-hover-bg.yml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/content-title-link-hover-bg.yml

diff --git a/app/assets/stylesheets/framework/gitlab-theme.scss b/app/assets/stylesheets/framework/gitlab-theme.scss
index 6b69e8018be..a6bdcf46aa7 100644
--- a/app/assets/stylesheets/framework/gitlab-theme.scss
+++ b/app/assets/stylesheets/framework/gitlab-theme.scss
@@ -95,7 +95,7 @@
     }
   }
 
-  .title {
+  .navbar .title {
     > a {
       &:hover,
       &:focus {
diff --git a/changelogs/unreleased/content-title-link-hover-bg.yml b/changelogs/unreleased/content-title-link-hover-bg.yml
new file mode 100644
index 00000000000..c4c31c2ad06
--- /dev/null
+++ b/changelogs/unreleased/content-title-link-hover-bg.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed navbar title colors leaking out of the navbar
+merge_request:
+author:
+type: fixed
-- 
cgit v1.2.1


From eda9e6b65baece281f45255e25a263e895d36db5 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Thu, 5 Oct 2017 15:14:33 +0200
Subject: Fixed Linting Error + Error with Line Highlighter found in Test

---
 app/assets/javascripts/line_highlighter.js              | 2 +-
 app/assets/javascripts/repo/components/repo_preview.vue | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/line_highlighter.js b/app/assets/javascripts/line_highlighter.js
index ef91d471639..a75d1a4b8d0 100644
--- a/app/assets/javascripts/line_highlighter.js
+++ b/app/assets/javascripts/line_highlighter.js
@@ -56,7 +56,7 @@ LineHighlighter.prototype.bindEvents = function() {
 
 LineHighlighter.prototype.highlightHash = function(newHash) {
   let range;
-  if (newHash) this._hash = newHash;
+  if (newHash && typeof newHash === 'string') this._hash = newHash;
 
   this.clearHighlight();
 
diff --git a/app/assets/javascripts/repo/components/repo_preview.vue b/app/assets/javascripts/repo/components/repo_preview.vue
index 514c7d9284c..04732489c5f 100644
--- a/app/assets/javascripts/repo/components/repo_preview.vue
+++ b/app/assets/javascripts/repo/components/repo_preview.vue
@@ -28,8 +28,8 @@ export default {
         this.highlightFile();
       });
     },
-    activeLine(e) {
-      this.lineHighlighter.highlightHash('#L' + Store.activeLine);
+    activeLine() {
+      this.lineHighlighter.highlightHash(`#L${Store.activeLine}`);
     },
   },
 };
-- 
cgit v1.2.1


From 62d540340120baac7fa432108a7847cbc2a1cbe5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Tue, 26 Sep 2017 19:42:23 -0500
Subject: Process and create subkeys when a new GPG key is created

---
 app/models/gpg_key.rb                               | 21 +++++++++++++++++++--
 .../20170926050624_add_parent_id_to_gpg_keys.rb     | 10 ++++++++++
 db/schema.rb                                        |  1 +
 lib/gitlab/gpg.rb                                   | 21 +++++++++++++++++++++
 4 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 54bd5b68777..cbf01183969 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -9,6 +9,7 @@ class GpgKey < ActiveRecord::Base
 
   belongs_to :user
   has_many :gpg_signatures
+  has_many :subkeys, class_name: 'GpgKey', foreign_key: :parent_id, dependent: :destroy
 
   validates :user, presence: true
 
@@ -18,7 +19,8 @@ class GpgKey < ActiveRecord::Base
     format: {
       with: /\A#{KEY_PREFIX}((?!#{KEY_PREFIX})(?!#{KEY_SUFFIX}).)+#{KEY_SUFFIX}\Z/m,
       message: "is invalid. A valid public GPG key begins with '#{KEY_PREFIX}' and ends with '#{KEY_SUFFIX}'"
-    }
+    },
+    unless: :parent_id?
 
   validates :fingerprint,
     presence: true,
@@ -34,8 +36,9 @@ class GpgKey < ActiveRecord::Base
     # the error about the fingerprint
     unless: -> { errors.has_key?(:key) }
 
-  before_validation :extract_fingerprint, :extract_primary_keyid
+  before_validation :extract_fingerprint, :extract_primary_keyid, unless: :parent_id?
   after_commit :update_invalid_gpg_signatures, on: :create
+  after_save :generate_subkeys, unless: :parent_id?
 
   def primary_keyid
     super&.upcase
@@ -106,4 +109,18 @@ class GpgKey < ActiveRecord::Base
     # only allows one key
     self.primary_keyid = Gitlab::Gpg.primary_keyids_from_key(key).first
   end
+
+  def generate_subkeys
+    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(key)
+
+    gpg_subkeys[primary_keyid].each do |subkey_data|
+      unless subkeys.where(fingerprint: subkey_data[:fingerprint]).exists?
+        subkeys.create!(
+          user: user,
+          primary_keyid: subkey_data[:keyid],
+          fingerprint: subkey_data[:fingerprint]
+        )
+      end
+    end
+  end
 end
diff --git a/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb b/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb
new file mode 100644
index 00000000000..ef7675be106
--- /dev/null
+++ b/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb
@@ -0,0 +1,10 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class AddParentIdToGpgKeys < ActiveRecord::Migration
+  DOWNTIME = false
+
+  def change
+    add_column :gpg_keys, :parent_id, :integer
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 17be774e9de..9b1457c9a03 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -586,6 +586,7 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.binary "primary_keyid"
     t.binary "fingerprint"
     t.text "key"
+    t.integer "parent_id"
   end
 
   add_index "gpg_keys", ["fingerprint"], name: "index_gpg_keys_on_fingerprint", unique: true, using: :btree
diff --git a/lib/gitlab/gpg.rb b/lib/gitlab/gpg.rb
index 0d5039ddf5f..be22a9e0fe2 100644
--- a/lib/gitlab/gpg.rb
+++ b/lib/gitlab/gpg.rb
@@ -34,6 +34,27 @@ module Gitlab
       end
     end
 
+    def subkeys_from_key(key)
+      using_tmp_keychain do
+        fingerprints    = CurrentKeyChain.fingerprints_from_key(key)
+        raw_keys        = GPGME::Key.find(:public, fingerprints)
+        grouped_subkeys = Hash.new { |h, k| h[k] = [] }
+
+        raw_keys.each_with_object(grouped_subkeys).each do |raw_key, subkeys|
+          primary_subkey_id = raw_key.primary_subkey.keyid
+
+          raw_key.subkeys.each do |subkey|
+            # Skip if current subkey is a master key
+            next if primary_subkey_id == subkey.keyid
+            # Skip if it isn't a sign key
+            next if subkey.capability.exclude?(:sign)
+
+            subkeys[primary_subkey_id] << { keyid: subkey.keyid, fingerprint: subkey.fingerprint }
+          end
+        end
+      end
+    end
+
     def user_infos_from_key(key)
       using_tmp_keychain do
         fingerprints = CurrentKeyChain.fingerprints_from_key(key)
-- 
cgit v1.2.1


From 37dcfb6e31a65d487424c0bf73874aabb2e69020 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Tue, 26 Sep 2017 22:10:10 -0500
Subject: Delegate #key to parent when working with a GPG subkey

The content returned by #key is important when veryfying the signature,
so given we don't want to repeat it in the database for GPG subkeys we
need to delegate it to the parent.
---
 app/models/gpg_key.rb | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index cbf01183969..683efcebee9 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -8,6 +8,7 @@ class GpgKey < ActiveRecord::Base
   sha_attribute :fingerprint
 
   belongs_to :user
+  belongs_to :parent, class_name: 'GpgKey'
   has_many :gpg_signatures
   has_many :subkeys, class_name: 'GpgKey', foreign_key: :parent_id, dependent: :destroy
 
@@ -48,6 +49,10 @@ class GpgKey < ActiveRecord::Base
     super&.upcase
   end
 
+  def key
+    parent_id? ? parent.key : super
+  end
+
   def key=(value)
     super(value&.strip)
   end
-- 
cgit v1.2.1


From 328f4a505bcd2e7b38f907a24df437f8c35bc3af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 12:27:39 -0500
Subject: Use a separate model to handle GPG subkeys

---
 app/models/gpg_key.rb                                  |  2 +-
 app/models/gpg_key_subkey.rb                           |  3 +++
 db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb | 10 ----------
 db/migrate/20170927161718_create_gpg_key_subkeys.rb    |  9 +++++++++
 db/schema.rb                                           | 10 +++++++++-
 5 files changed, 22 insertions(+), 12 deletions(-)
 create mode 100644 app/models/gpg_key_subkey.rb
 delete mode 100644 db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb
 create mode 100644 db/migrate/20170927161718_create_gpg_key_subkeys.rb

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 683efcebee9..110ff4ee59c 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -10,7 +10,7 @@ class GpgKey < ActiveRecord::Base
   belongs_to :user
   belongs_to :parent, class_name: 'GpgKey'
   has_many :gpg_signatures
-  has_many :subkeys, class_name: 'GpgKey', foreign_key: :parent_id, dependent: :destroy
+  has_many :subkeys, class_name: 'GpgKeySubkey'
 
   validates :user, presence: true
 
diff --git a/app/models/gpg_key_subkey.rb b/app/models/gpg_key_subkey.rb
new file mode 100644
index 00000000000..4f967f1e47c
--- /dev/null
+++ b/app/models/gpg_key_subkey.rb
@@ -0,0 +1,3 @@
+class GpgKeySubkey < ActiveRecord::Base
+  belongs_to :gpg_key
+end
diff --git a/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb b/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb
deleted file mode 100644
index ef7675be106..00000000000
--- a/db/migrate/20170926050624_add_parent_id_to_gpg_keys.rb
+++ /dev/null
@@ -1,10 +0,0 @@
-# See http://doc.gitlab.com/ce/development/migration_style_guide.html
-# for more information on how to write migrations for GitLab.
-
-class AddParentIdToGpgKeys < ActiveRecord::Migration
-  DOWNTIME = false
-
-  def change
-    add_column :gpg_keys, :parent_id, :integer
-  end
-end
diff --git a/db/migrate/20170927161718_create_gpg_key_subkeys.rb b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
new file mode 100644
index 00000000000..d61b669f517
--- /dev/null
+++ b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
@@ -0,0 +1,9 @@
+class CreateGpgKeySubkeys < ActiveRecord::Migration
+  def change
+    create_table :gpg_key_subkeys do |t|
+      t.binary :keyid
+      t.binary :fingerprint
+      t.references :gpg_key, null: false, index: true, foreign_key: { on_delete: :cascade }
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 9b1457c9a03..0d02e584d0c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -579,6 +579,14 @@ ActiveRecord::Schema.define(version: 20171004121444) do
 
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
+  create_table "gpg_key_subkeys", force: :cascade do |t|
+    t.binary "keyid"
+    t.binary "fingerprint"
+    t.integer "gpg_key_id", null: false
+  end
+
+  add_index "gpg_key_subkeys", ["gpg_key_id"], name: "index_gpg_key_subkeys_on_gpg_key_id", using: :btree
+
   create_table "gpg_keys", force: :cascade do |t|
     t.datetime_with_timezone "created_at", null: false
     t.datetime_with_timezone "updated_at", null: false
@@ -586,7 +594,6 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.binary "primary_keyid"
     t.binary "fingerprint"
     t.text "key"
-    t.integer "parent_id"
   end
 
   add_index "gpg_keys", ["fingerprint"], name: "index_gpg_keys_on_fingerprint", unique: true, using: :btree
@@ -1727,6 +1734,7 @@ ActiveRecord::Schema.define(version: 20171004121444) do
   add_foreign_key "events", "projects", on_delete: :cascade
   add_foreign_key "events", "users", column: "author_id", name: "fk_edfd187b6f", on_delete: :cascade
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
+  add_foreign_key "gpg_key_subkeys", "gpg_keys", on_delete: :cascade
   add_foreign_key "gpg_keys", "users", on_delete: :cascade
   add_foreign_key "gpg_signatures", "gpg_keys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "projects", on_delete: :cascade
-- 
cgit v1.2.1


From d0572d9aad2c434a040f11956a4c3feac1afdcf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 12:28:50 -0500
Subject: Refactor the extraction and generation of GPG subkeys

---
 app/models/gpg_key.rb | 19 ++++---------------
 lib/gitlab/gpg.rb     |  7 +------
 2 files changed, 5 insertions(+), 21 deletions(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 110ff4ee59c..ed09b44027c 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -20,8 +20,7 @@ class GpgKey < ActiveRecord::Base
     format: {
       with: /\A#{KEY_PREFIX}((?!#{KEY_PREFIX})(?!#{KEY_SUFFIX}).)+#{KEY_SUFFIX}\Z/m,
       message: "is invalid. A valid public GPG key begins with '#{KEY_PREFIX}' and ends with '#{KEY_SUFFIX}'"
-    },
-    unless: :parent_id?
+    }
 
   validates :fingerprint,
     presence: true,
@@ -37,9 +36,9 @@ class GpgKey < ActiveRecord::Base
     # the error about the fingerprint
     unless: -> { errors.has_key?(:key) }
 
-  before_validation :extract_fingerprint, :extract_primary_keyid, unless: :parent_id?
+  before_validation :extract_fingerprint, :extract_primary_keyid
   after_commit :update_invalid_gpg_signatures, on: :create
-  after_save :generate_subkeys, unless: :parent_id?
+  after_create :generate_subkeys
 
   def primary_keyid
     super&.upcase
@@ -49,10 +48,6 @@ class GpgKey < ActiveRecord::Base
     super&.upcase
   end
 
-  def key
-    parent_id? ? parent.key : super
-  end
-
   def key=(value)
     super(value&.strip)
   end
@@ -119,13 +114,7 @@ class GpgKey < ActiveRecord::Base
     gpg_subkeys = Gitlab::Gpg.subkeys_from_key(key)
 
     gpg_subkeys[primary_keyid].each do |subkey_data|
-      unless subkeys.where(fingerprint: subkey_data[:fingerprint]).exists?
-        subkeys.create!(
-          user: user,
-          primary_keyid: subkey_data[:keyid],
-          fingerprint: subkey_data[:fingerprint]
-        )
-      end
+      subkeys.create!(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
     end
   end
 end
diff --git a/lib/gitlab/gpg.rb b/lib/gitlab/gpg.rb
index be22a9e0fe2..343bf54a6ae 100644
--- a/lib/gitlab/gpg.rb
+++ b/lib/gitlab/gpg.rb
@@ -43,12 +43,7 @@ module Gitlab
         raw_keys.each_with_object(grouped_subkeys).each do |raw_key, subkeys|
           primary_subkey_id = raw_key.primary_subkey.keyid
 
-          raw_key.subkeys.each do |subkey|
-            # Skip if current subkey is a master key
-            next if primary_subkey_id == subkey.keyid
-            # Skip if it isn't a sign key
-            next if subkey.capability.exclude?(:sign)
-
+          raw_key.subkeys[1..-1].each do |subkey|
             subkeys[primary_subkey_id] << { keyid: subkey.keyid, fingerprint: subkey.fingerprint }
           end
         end
-- 
cgit v1.2.1


From a41e7e0105e238161ba697ebf26d8554ae59d295 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 16:11:42 -0500
Subject: Add ability to include subkeys when finding by fingerprint

---
 app/models/gpg_key.rb    | 11 +++++++++++
 lib/gitlab/gpg/commit.rb |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index ed09b44027c..6d3537b6fcf 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -40,6 +40,17 @@ class GpgKey < ActiveRecord::Base
   after_commit :update_invalid_gpg_signatures, on: :create
   after_create :generate_subkeys
 
+  def self.find_with_subkeys(fingerprint)
+    keys_table = arel_table
+    subkeys_table = GpgKeySubkey.arel_table
+
+    condition = keys_table[:primary_keyid].eq(fingerprint).or(
+      subkeys_table[:keyid].eq(fingerprint)
+    )
+
+    joins(:subkeys).where(condition).first
+  end
+
   def primary_keyid
     super&.upcase
   end
diff --git a/lib/gitlab/gpg/commit.rb b/lib/gitlab/gpg/commit.rb
index 86bd9f5b125..40274e13918 100644
--- a/lib/gitlab/gpg/commit.rb
+++ b/lib/gitlab/gpg/commit.rb
@@ -43,7 +43,7 @@ module Gitlab
           # key belonging to the keyid.
           # This way we can add the key to the temporary keychain and extract
           # the proper signature.
-          gpg_key = GpgKey.find_by(primary_keyid: verified_signature.fingerprint)
+          gpg_key = GpgKey.find_with_subkeys(verified_signature.fingerprint)
 
           if gpg_key
             Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
-- 
cgit v1.2.1


From 9b4990a4d71b057f0fec14399cd1f2a421901963 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 19:45:19 -0500
Subject: Associate GgpSignature with GpgKeySubkey if comes from a subkey

Additionally we're delegating missing method calls on GpgKeySubkey to
GpgKey since most of the info required when verifying a signature is
found on GpgKey which is the parent of GpgKeySubkey
---
 app/models/gpg_key.rb                                    | 11 -----------
 app/models/gpg_key_subkey.rb                             | 15 +++++++++++++++
 app/models/gpg_signature.rb                              | 16 ++++++++++++++++
 ...0927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb | 10 ++++++++++
 db/schema.rb                                             |  3 +++
 lib/gitlab/gpg/commit.rb                                 | 14 ++++++++++++--
 6 files changed, 56 insertions(+), 13 deletions(-)
 create mode 100644 db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 6d3537b6fcf..ed09b44027c 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -40,17 +40,6 @@ class GpgKey < ActiveRecord::Base
   after_commit :update_invalid_gpg_signatures, on: :create
   after_create :generate_subkeys
 
-  def self.find_with_subkeys(fingerprint)
-    keys_table = arel_table
-    subkeys_table = GpgKeySubkey.arel_table
-
-    condition = keys_table[:primary_keyid].eq(fingerprint).or(
-      subkeys_table[:keyid].eq(fingerprint)
-    )
-
-    joins(:subkeys).where(condition).first
-  end
-
   def primary_keyid
     super&.upcase
   end
diff --git a/app/models/gpg_key_subkey.rb b/app/models/gpg_key_subkey.rb
index 4f967f1e47c..8222e5606aa 100644
--- a/app/models/gpg_key_subkey.rb
+++ b/app/models/gpg_key_subkey.rb
@@ -1,3 +1,18 @@
 class GpgKeySubkey < ActiveRecord::Base
+  include ShaAttribute
+
+  sha_attribute :keyid
+  sha_attribute :fingerprint
+
   belongs_to :gpg_key
+
+  def method_missing(m, *a, &b)
+    return super unless gpg_key.respond_to?(m)
+
+    gpg_key.public_send(m, *a, &b) # rubocop:disable GitlabSecurity/PublicSend
+  end
+
+  def respond_to_missing?(method, include_private = false)
+    gpg_key.respond_to?(method, include_private) || super
+  end
 end
diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index 1f047a32c84..c7f75288407 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -15,11 +15,27 @@ class GpgSignature < ActiveRecord::Base
 
   belongs_to :project
   belongs_to :gpg_key
+  belongs_to :gpg_key_subkey
 
   validates :commit_sha, presence: true
   validates :project_id, presence: true
   validates :gpg_key_primary_keyid, presence: true
 
+  def gpg_key=(model)
+    case model
+    when GpgKey       then super
+    when GpgKeySubkey then write_attribute(:gpg_key_subkey_id, model.id)
+    end
+  end
+
+  def gpg_key
+    if gpg_key_id
+      super
+    elsif gpg_key_subkey_id
+      gpg_key_subkey
+    end
+  end
+
   def gpg_key_primary_keyid
     super&.upcase
   end
diff --git a/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb b/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb
new file mode 100644
index 00000000000..74b43d732d5
--- /dev/null
+++ b/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb
@@ -0,0 +1,10 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class AddGpgKeySubkeyIdToGpgSignatures < ActiveRecord::Migration
+  DOWNTIME = false
+
+  def change
+    add_reference(:gpg_signatures, :gpg_key_subkey, index: true, foreign_key: { on_delete: :nullify })
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 0d02e584d0c..0beebc16cbb 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -610,11 +610,13 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.text "gpg_key_user_name"
     t.text "gpg_key_user_email"
     t.integer "verification_status", limit: 2, default: 0, null: false
+    t.integer "gpg_key_subkey_id"
   end
 
   add_index "gpg_signatures", ["commit_sha"], name: "index_gpg_signatures_on_commit_sha", unique: true, using: :btree
   add_index "gpg_signatures", ["gpg_key_id"], name: "index_gpg_signatures_on_gpg_key_id", using: :btree
   add_index "gpg_signatures", ["gpg_key_primary_keyid"], name: "index_gpg_signatures_on_gpg_key_primary_keyid", using: :btree
+  add_index "gpg_signatures", ["gpg_key_subkey_id"], name: "index_gpg_signatures_on_gpg_key_subkey_id", using: :btree
   add_index "gpg_signatures", ["project_id"], name: "index_gpg_signatures_on_project_id", using: :btree
 
   create_table "identities", force: :cascade do |t|
@@ -1736,6 +1738,7 @@ ActiveRecord::Schema.define(version: 20171004121444) do
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
   add_foreign_key "gpg_key_subkeys", "gpg_keys", on_delete: :cascade
   add_foreign_key "gpg_keys", "users", on_delete: :cascade
+  add_foreign_key "gpg_signatures", "gpg_key_subkeys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "gpg_keys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "projects", on_delete: :cascade
   add_foreign_key "issue_assignees", "issues", name: "fk_b7d881734a", on_delete: :cascade
diff --git a/lib/gitlab/gpg/commit.rb b/lib/gitlab/gpg/commit.rb
index 40274e13918..5cbc836314f 100644
--- a/lib/gitlab/gpg/commit.rb
+++ b/lib/gitlab/gpg/commit.rb
@@ -43,7 +43,7 @@ module Gitlab
           # key belonging to the keyid.
           # This way we can add the key to the temporary keychain and extract
           # the proper signature.
-          gpg_key = GpgKey.find_with_subkeys(verified_signature.fingerprint)
+          gpg_key = find_gpg_key(verified_signature.fingerprint)
 
           if gpg_key
             Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
@@ -74,7 +74,7 @@ module Gitlab
           commit_sha: @commit.sha,
           project: @commit.project,
           gpg_key: gpg_key,
-          gpg_key_primary_keyid: gpg_key&.primary_keyid || verified_signature.fingerprint,
+          gpg_key_primary_keyid: gpg_keyid(gpg_key) || verified_signature.fingerprint,
           gpg_key_user_name: user_infos[:name],
           gpg_key_user_email: user_infos[:email],
           verification_status: verification_status
@@ -98,6 +98,16 @@ module Gitlab
       def user_infos(gpg_key)
         gpg_key&.verified_user_infos&.first || gpg_key&.user_infos&.first || {}
       end
+
+      def gpg_keyid(gpg_key)
+        return nil unless gpg_key
+
+        gpg_key.is_a?(GpgKey) ? gpg_key.primary_keyid : gpg_key.keyid
+      end
+
+      def find_gpg_key(keyid)
+        GpgKey.find_by(primary_keyid: keyid) || GpgKeySubkey.find_by(keyid: keyid)
+      end
     end
   end
 end
-- 
cgit v1.2.1


From c73748e3c4409de7ab945f502d55fe4d62ebd5eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 20:45:08 -0500
Subject: Render GPG subkeys on index page

---
 app/assets/stylesheets/pages/profile.scss       | 9 +++++++++
 app/controllers/profiles/gpg_keys_controller.rb | 2 +-
 app/models/gpg_key.rb                           | 2 ++
 app/views/profiles/gpg_keys/_key.html.haml      | 7 +++++++
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/pages/profile.scss b/app/assets/stylesheets/pages/profile.scss
index 6c521bb06ee..eab39f698c3 100644
--- a/app/assets/stylesheets/pages/profile.scss
+++ b/app/assets/stylesheets/pages/profile.scss
@@ -108,6 +108,15 @@
   }
 }
 
+.subkeys-list {
+  @include basic-list;
+
+  li {
+    padding: 3px 0;
+    border: none;
+  }
+}
+
 .key-list-item {
   .key-list-item-info {
     @media (min-width: $screen-sm-min) {
diff --git a/app/controllers/profiles/gpg_keys_controller.rb b/app/controllers/profiles/gpg_keys_controller.rb
index 689c76059f6..38e3eacd229 100644
--- a/app/controllers/profiles/gpg_keys_controller.rb
+++ b/app/controllers/profiles/gpg_keys_controller.rb
@@ -2,7 +2,7 @@ class Profiles::GpgKeysController < Profiles::ApplicationController
   before_action :set_gpg_key, only: [:destroy, :revoke]
 
   def index
-    @gpg_keys = current_user.gpg_keys
+    @gpg_keys = current_user.gpg_keys.with_subkeys
     @gpg_key = GpgKey.new
   end
 
diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index ed09b44027c..e6c862d9b55 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -12,6 +12,8 @@ class GpgKey < ActiveRecord::Base
   has_many :gpg_signatures
   has_many :subkeys, class_name: 'GpgKeySubkey'
 
+  scope :with_subkeys, -> { includes(:subkeys) }
+
   validates :user, presence: true
 
   validates :key,
diff --git a/app/views/profiles/gpg_keys/_key.html.haml b/app/views/profiles/gpg_keys/_key.html.haml
index 970e92aadaa..5ed517c1ef6 100644
--- a/app/views/profiles/gpg_keys/_key.html.haml
+++ b/app/views/profiles/gpg_keys/_key.html.haml
@@ -7,6 +7,13 @@
 
     .description
       %code= key.fingerprint
+    - if key.subkeys.present?
+      .subkeys
+        %span.bold Subkeys:
+        %ul.subkeys-list
+          - key.subkeys.each do |subkey|
+            %li
+              %code= subkey.fingerprint
   .pull-right
     %span.key-created-at
       created #{time_ago_with_tooltip(key.created_at)}
-- 
cgit v1.2.1


From 4b6d045c0c3c8d8ab70dd80feb960f193e498d7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 27 Sep 2017 20:47:15 -0500
Subject: Add missing DOWNTIME declaration

---
 db/migrate/20170927161718_create_gpg_key_subkeys.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/db/migrate/20170927161718_create_gpg_key_subkeys.rb b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
index d61b669f517..9f69e299874 100644
--- a/db/migrate/20170927161718_create_gpg_key_subkeys.rb
+++ b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
@@ -1,4 +1,6 @@
 class CreateGpgKeySubkeys < ActiveRecord::Migration
+  DOWNTIME = false
+
   def change
     create_table :gpg_key_subkeys do |t|
       t.binary :keyid
-- 
cgit v1.2.1


From b27549df97151f773c6fbfac4c9dc3aa491a8b5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 28 Sep 2017 13:26:16 -0500
Subject: Add some basic specs and refactor model and validations

---
 app/models/gpg_key_subkey.rb                       | 11 ++++++
 .../20170927161718_create_gpg_key_subkeys.rb       | 14 +++++++-
 ...2658_add_gpg_key_subkey_id_to_gpg_signatures.rb | 10 ------
 db/schema.rb                                       |  2 ++
 spec/factories/gpg_key_subkeys.rb                  | 10 ++++++
 spec/factories/gpg_keys.rb                         |  4 +++
 spec/models/gpg_key_spec.rb                        |  9 +++++
 spec/models/gpg_key_subkey_spec.rb                 | 15 ++++++++
 spec/services/gpg_keys/create_service_spec.rb      | 10 ++++++
 spec/support/gpg_helpers.rb                        | 40 ++++++++++++++++++++++
 10 files changed, 114 insertions(+), 11 deletions(-)
 delete mode 100644 db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb
 create mode 100644 spec/factories/gpg_key_subkeys.rb
 create mode 100644 spec/models/gpg_key_subkey_spec.rb

diff --git a/app/models/gpg_key_subkey.rb b/app/models/gpg_key_subkey.rb
index 8222e5606aa..b4f146e5647 100644
--- a/app/models/gpg_key_subkey.rb
+++ b/app/models/gpg_key_subkey.rb
@@ -6,6 +6,17 @@ class GpgKeySubkey < ActiveRecord::Base
 
   belongs_to :gpg_key
 
+  validates :gpg_key_id, presence: true
+  validates :fingerprint, :keyid, presence: true, uniqueness: true
+
+  def keyid
+    super&.upcase
+  end
+
+  def fingerprint
+    super&.upcase
+  end
+
   def method_missing(m, *a, &b)
     return super unless gpg_key.respond_to?(m)
 
diff --git a/db/migrate/20170927161718_create_gpg_key_subkeys.rb b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
index 9f69e299874..ffe06ce1231 100644
--- a/db/migrate/20170927161718_create_gpg_key_subkeys.rb
+++ b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
@@ -1,11 +1,23 @@
 class CreateGpgKeySubkeys < ActiveRecord::Migration
   DOWNTIME = false
 
-  def change
+  def up
     create_table :gpg_key_subkeys do |t|
       t.binary :keyid
       t.binary :fingerprint
+
       t.references :gpg_key, null: false, index: true, foreign_key: { on_delete: :cascade }
+
+      t.index :keyid, unique: true, length: Gitlab::Database.mysql? ? 20 : nil
+      t.index :fingerprint, unique: true, length: Gitlab::Database.mysql? ? 20 : nil
     end
+
+    add_reference :gpg_signatures, :gpg_key_subkey, index: true, foreign_key: { on_delete: :nullify }
+  end
+
+  def down
+    remove_reference(:gpg_signatures, :gpg_key_subkey, index: true, foreign_key: true)
+
+    drop_table :gpg_key_subkeys
   end
 end
diff --git a/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb b/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb
deleted file mode 100644
index 74b43d732d5..00000000000
--- a/db/migrate/20170927232658_add_gpg_key_subkey_id_to_gpg_signatures.rb
+++ /dev/null
@@ -1,10 +0,0 @@
-# See http://doc.gitlab.com/ce/development/migration_style_guide.html
-# for more information on how to write migrations for GitLab.
-
-class AddGpgKeySubkeyIdToGpgSignatures < ActiveRecord::Migration
-  DOWNTIME = false
-
-  def change
-    add_reference(:gpg_signatures, :gpg_key_subkey, index: true, foreign_key: { on_delete: :nullify })
-  end
-end
diff --git a/db/schema.rb b/db/schema.rb
index 0beebc16cbb..b9de70b742a 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -585,7 +585,9 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.integer "gpg_key_id", null: false
   end
 
+  add_index "gpg_key_subkeys", ["fingerprint"], name: "index_gpg_key_subkeys_on_fingerprint", unique: true, using: :btree
   add_index "gpg_key_subkeys", ["gpg_key_id"], name: "index_gpg_key_subkeys_on_gpg_key_id", using: :btree
+  add_index "gpg_key_subkeys", ["keyid"], name: "index_gpg_key_subkeys_on_keyid", unique: true, using: :btree
 
   create_table "gpg_keys", force: :cascade do |t|
     t.datetime_with_timezone "created_at", null: false
diff --git a/spec/factories/gpg_key_subkeys.rb b/spec/factories/gpg_key_subkeys.rb
new file mode 100644
index 00000000000..d896b4e217e
--- /dev/null
+++ b/spec/factories/gpg_key_subkeys.rb
@@ -0,0 +1,10 @@
+require_relative '../support/gpg_helpers'
+
+FactoryGirl.define do
+  factory :gpg_key_subkey do
+    gpg_key
+
+    keyid { gpg_key.subkeys.last.keyid }
+    fingerprint { gpg_key.subkeys.last.fingerprint }
+  end
+end
diff --git a/spec/factories/gpg_keys.rb b/spec/factories/gpg_keys.rb
index 1258dce8940..93218e5763e 100644
--- a/spec/factories/gpg_keys.rb
+++ b/spec/factories/gpg_keys.rb
@@ -4,5 +4,9 @@ FactoryGirl.define do
   factory :gpg_key do
     key GpgHelpers::User1.public_key
     user
+
+    factory :gpg_key_with_subkeys do
+      key GpgHelpers::User1.public_key_with_extra_signing_key
+    end
   end
 end
diff --git a/spec/models/gpg_key_spec.rb b/spec/models/gpg_key_spec.rb
index 743f2cfcab5..69d6090e034 100644
--- a/spec/models/gpg_key_spec.rb
+++ b/spec/models/gpg_key_spec.rb
@@ -3,6 +3,7 @@ require 'rails_helper'
 describe GpgKey do
   describe "associations" do
     it { is_expected.to belong_to(:user) }
+    it { is_expected.to have_many(:subkeys) }
   end
 
   describe "validation" do
@@ -38,6 +39,14 @@ describe GpgKey do
         expect(gpg_key.primary_keyid).to eq GpgHelpers::User1.primary_keyid
       end
     end
+
+    describe 'generate_subkeys' do
+      it 'extracts the subkeys from the gpg key' do
+        gpg_key = create(:gpg_key, key: GpgHelpers::User1.public_key_with_extra_signing_key)
+
+        expect(gpg_key.subkeys.count).to eq(2)
+      end
+    end
   end
 
   describe '#key=' do
diff --git a/spec/models/gpg_key_subkey_spec.rb b/spec/models/gpg_key_subkey_spec.rb
new file mode 100644
index 00000000000..3c86837f47f
--- /dev/null
+++ b/spec/models/gpg_key_subkey_spec.rb
@@ -0,0 +1,15 @@
+require 'rails_helper'
+
+describe GpgKeySubkey do
+  subject { build(:gpg_key_subkey) }
+
+  describe 'associations' do
+    it { is_expected.to belong_to(:gpg_key) }
+  end
+
+  describe 'validations' do
+    it { is_expected.to validate_presence_of(:gpg_key_id) }
+    it { is_expected.to validate_presence_of(:fingerprint) }
+    it { is_expected.to validate_presence_of(:keyid) }
+  end
+end
diff --git a/spec/services/gpg_keys/create_service_spec.rb b/spec/services/gpg_keys/create_service_spec.rb
index 20382a3a618..1cd2625531e 100644
--- a/spec/services/gpg_keys/create_service_spec.rb
+++ b/spec/services/gpg_keys/create_service_spec.rb
@@ -18,4 +18,14 @@ describe GpgKeys::CreateService do
   it 'creates a gpg key' do
     expect { subject.execute }.to change { user.gpg_keys.where(params).count }.by(1)
   end
+
+  context 'when the public key contains subkeys' do
+    let(:params) { attributes_for(:gpg_key_with_subkeys) }
+
+    it 'generates the gpg subkeys' do
+      gpg_key = subject.execute
+
+      expect(gpg_key.subkeys.count).to eq(2)
+    end
+  end
 end
diff --git a/spec/support/gpg_helpers.rb b/spec/support/gpg_helpers.rb
index 65b38626a51..a8cfd72954e 100644
--- a/spec/support/gpg_helpers.rb
+++ b/spec/support/gpg_helpers.rb
@@ -92,6 +92,46 @@ module GpgHelpers
       KEY
     end
 
+    def public_key_with_extra_signing_key
+      <<~KEY.strip
+        -----BEGIN PGP PUBLIC KEY BLOCK-----
+        Version: GnuPG v1
+
+        mI0EWK7VJwEEANSFayuVYenl7sBKUjmIxwDRc3jd+K+FWUZgknLgiLcevaLh/mxV
+        98dLxDKGDHHNKc/B7Y4qdlZYv1wfNQVuIbd8dqUQFOOkH7ukbgcGBTxH+2IM67y+
+        QBH618luS5Gz1d4bd0YoFf/xZGEh9G5xicz7TiXYzLKjnMjHu2EmbFePABEBAAG0
+        LU5hbm5pZSBCZXJuaGFyZCA8bmFubmllLmJlcm5oYXJkQGV4YW1wbGUuY29tPoi4
+        BBMBAgAiBQJYrtUnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRDM++Gf
+        AKyLHaeSA/99oUWpb02PlfkALcx5RncboMHkgczYEU9wOFIgvXIReswThCMOvPZa
+        piui+ItyJfV3ijJfO8IvbbFcvU7jjGA073Bb7tbzAEOQLA16mWgBLQlGaRWbHDW4
+        uwFxvkJKA0GzEsadEXeniESaZPc4rOXKPO3+/MSQWS2bmvvGsBTEuriNBFiu1ScB
+        BADIXkITf+kKCkD+n8tMsdTLInefu8KrJ8p7YRYCCabEXnWRsDb5zxUAG2VXCVUh
+        Yl6QXQybkNiBaduS+uxilz7gtYZUMFJvQ09+fV7D2N9B7u/1bGdIYz+cDFJnEJit
+        LY4w/nju2Sno5CL5Ead8sZuslKetSXPYHR/kbW462EOw5wARAQABiJ8EGAECAAkF
+        Aliu1ScCGwwACgkQzPvhnwCsix2WRQQAtOXpBS60myrBUXhlcqabDQgSTw+Spbgb
+        61hEMckyzpk7SfMNLz0EbYMvj9SU6znBG8RGeUljPTVMxPGr9yIpoFMSPKAUi/0K
+        AgRmH3tVpxlMipwXjST1Jukk2eHckt/3jGw3E1ElMSFtULe6u5p4gu578hHukEwT
+        IKzj0ZyC7DK5AQ0EWcx23AEIANwpAq85bT10JCBuNhOMyF2jKVt5wHbI9wBtjWYG
+        fgJFBkRvm6IsbmR0Y5DSBvF/of0UX1iGMfx6mvCDJkb1okquhCUef6MONWRpzXYE
+        CIZDm1TXu6yv0D35tkLfPo+/sY9UHHp1zGRcPAU46e8ztRwoD+zEJwy7lobLHGOL
+        9OdWtCGjsutLOTqKRK4jsifr8n3rePU09rejhDkRONNs7ufn9GRcWMN7RWiFDtpU
+        gNe84AJ38qaXPU8GHNTrDtDtRRPmn68ezMmE1qTNsxQxD4Isexe5Wsfc4+ElaP9s
+        zaHgij7npX1HS9RpmhnOa2h1ESroM9cqDh3IJVhf+eP6/uMAEQEAAYkBxAQYAQIA
+        DwUCWcx23AIbAgUJAeEzgAEpCRDM++GfAKyLHcBdIAQZAQIABgUCWcx23AAKCRDk
+        garE0uOuES7DCAC2Kgl6zO+NqIBIS6McgcEN0sGyvOvZ8Ps4hBiMwCyDAnsIRAUi
+        v4KZMtQMAyl9njJ3YjPWBsdieuTz45O06DDnrzJpZO5rUGJjAcEue4zvRRWIyu3H
+        qHC8MsvkslsNCygJHoWlknm+HucroskTNtxHQ+FdKZ6Tey+twl1u+PhV8PQVyFkl
+        4G1chO90EP4dvYrye26CC+ik2JkvC7Vy5M+U0PJikme8pFMjcdNks25BnAKcdqKU
+        AU8RTkSjoYvb8qSmZyldJjYjQRkTPRX1ZdaOID1EdiWl+s5cn0Oypo3z7BChcEMx
+        IWB/gmXQJQXVr5qNQnJObyMO/RczXYi9qNnyGMED/2EJJERLR0nefjHQalwDKQVP
+        s5lX1OKAcf2CrV6ZarckqaQgtqjZbuV2C2mrOHUs5uojlXaopj5gA4yJSGDcYhj1
+        Rg9jdHWBtkHBj3eL32ZqrHDs3ap8ErZMmPE8A+mn9TTnQS+FY2QF7vBjJKM3qPT7
+        DMVGWrg4m1NF8N6yMPMP
+        =RB1y
+        -----END PGP PUBLIC KEY BLOCK-----
+      KEY
+    end
+
     def primary_keyid
       fingerprint[-16..-1]
     end
-- 
cgit v1.2.1


From 866ef2bb2ed601618c77d39f3462ddca9601bc44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 28 Sep 2017 19:57:49 -0500
Subject: Add more specs to cover subkeys scenarios

---
 spec/features/profiles/gpg_keys_spec.rb |  12 ++
 spec/lib/gitlab/gpg/commit_spec.rb      |  39 +++++++
 spec/models/gpg_signature_spec.rb       |   1 +
 spec/support/gpg_helpers.rb             | 200 ++++++++++++++++++++++++++++++++
 4 files changed, 252 insertions(+)

diff --git a/spec/features/profiles/gpg_keys_spec.rb b/spec/features/profiles/gpg_keys_spec.rb
index b0f6848bc4b..59233e92f93 100644
--- a/spec/features/profiles/gpg_keys_spec.rb
+++ b/spec/features/profiles/gpg_keys_spec.rb
@@ -20,6 +20,18 @@ feature 'Profile > GPG Keys' do
       expect(page).to have_content('bette.cartwright@example.net Unverified')
       expect(page).to have_content(GpgHelpers::User2.fingerprint)
     end
+
+    scenario 'with multiple subkeys' do
+      fill_in('Key', with: GpgHelpers::User3.public_key)
+      click_button('Add key')
+
+      expect(page).to have_content('john.doe@example.com Unverified')
+      expect(page).to have_content(GpgHelpers::User3.fingerprint)
+
+      GpgHelpers::User3.subkey_fingerprints.each do |fingerprint|
+        expect(page).to have_content(fingerprint)
+      end
+    end
   end
 
   scenario 'User sees their key' do
diff --git a/spec/lib/gitlab/gpg/commit_spec.rb b/spec/lib/gitlab/gpg/commit_spec.rb
index b07462e4978..a6c99bc07d4 100644
--- a/spec/lib/gitlab/gpg/commit_spec.rb
+++ b/spec/lib/gitlab/gpg/commit_spec.rb
@@ -63,6 +63,45 @@ describe Gitlab::Gpg::Commit do
           it_behaves_like 'returns the cached signature on second call'
         end
 
+        context 'commit signed with a subkey' do
+          let!(:commit) { create :commit, project: project, sha: commit_sha, committer_email: GpgHelpers::User3.emails.first }
+
+          let!(:user) { create(:user, email: GpgHelpers::User3.emails.first) }
+
+          let!(:gpg_key) do
+            create :gpg_key, key: GpgHelpers::User3.public_key, user: user
+          end
+
+          let(:gpg_key_subkey) do
+            gpg_key.subkeys.find_by(fingerprint: '0522DD29B98F167CD8421752E38FFCAF75ABD92A')
+          end
+
+          before do
+            allow(Rugged::Commit).to receive(:extract_signature)
+            .with(Rugged::Repository, commit_sha)
+            .and_return(
+              [
+                GpgHelpers::User3.signed_commit_signature,
+                GpgHelpers::User3.signed_commit_base_data
+              ]
+            )
+          end
+
+          it 'returns a valid signature' do
+            expect(described_class.new(commit).signature).to have_attributes(
+              commit_sha: commit_sha,
+              project: project,
+              gpg_key: gpg_key_subkey,
+              gpg_key_primary_keyid: gpg_key_subkey.keyid,
+              gpg_key_user_name: GpgHelpers::User3.names.first,
+              gpg_key_user_email: GpgHelpers::User3.emails.first,
+              verification_status: 'verified'
+            )
+          end
+
+          it_behaves_like 'returns the cached signature on second call'
+        end
+
         context 'user email does not match the committer email, but is the same user' do
           let!(:commit) { create :commit, project: project, sha: commit_sha, committer_email: GpgHelpers::User2.emails.first }
 
diff --git a/spec/models/gpg_signature_spec.rb b/spec/models/gpg_signature_spec.rb
index c58fd46762a..91d4efe8e2b 100644
--- a/spec/models/gpg_signature_spec.rb
+++ b/spec/models/gpg_signature_spec.rb
@@ -4,6 +4,7 @@ RSpec.describe GpgSignature do
   describe 'associations' do
     it { is_expected.to belong_to(:project) }
     it { is_expected.to belong_to(:gpg_key) }
+    it { is_expected.to belong_to(:gpg_key_subkey) }
   end
 
   describe 'validation' do
diff --git a/spec/support/gpg_helpers.rb b/spec/support/gpg_helpers.rb
index a8cfd72954e..4b1ca7ff9c8 100644
--- a/spec/support/gpg_helpers.rb
+++ b/spec/support/gpg_helpers.rb
@@ -241,4 +241,204 @@ module GpgHelpers
       ['bette.cartwright@example.com', 'bette.cartwright@example.net']
     end
   end
+
+  # GPG Key with extra signing key
+  module User3
+    extend self
+
+    def signed_commit_signature
+      <<~SIGNATURE
+        -----BEGIN PGP SIGNATURE-----
+
+        iQEzBAABCAAdFiEEBSLdKbmPFnzYQhdS44/8r3Wr2SoFAlnNlT8ACgkQ44/8r3Wr
+        2SqP1wf9FC4J2S8LIHs/fpxgkYzsyCp5lCbS7JuoD4pqmI2KWyBx+vi9/3mZPCsm
+        Fj9f0vFEtNOb39GNGZbaA8DdGw30/WAS6kI6yco0WSK53KHrLw9Kqd+3e/NAVSsl
+        991Gq4n8X1U5izSH+gZOMtEEUBGqIlZKgRrEh7lhNcz0G7JTF2VCE4NNtZdq7GDA
+        N6jOQxDGUwi9wQBYORQzIBc3NihfhGloII1hXf0XzrgUY3zNYHTT7QipCxKAmH54
+        skwW+wi8RpBedar4saf7fs5xZbP/0yyVz98MJMdHBL68++Xt1AIHoqrb7eWszqnd
+        PCo/fnz1iHKCig602KLj0/zhADcNkg==
+        =LsTi
+        -----END PGP SIGNATURE-----
+      SIGNATURE
+    end
+
+    def signed_commit_base_data
+      <<~SIGNEDDATA
+        tree 86ec18bfe87ad42a782fdabd8310f9b7ac750f51
+        parent 2d1096e3a0ecf1d2baf6dee036cc80775d4940ba
+        author John Doe <john.doe@example.com> 1506645311 -0500
+        committer John Doe <john.doe@example.com> 1506645311 -0500
+
+        Commit signed with subkey by John Doe
+      SIGNEDDATA
+    end
+
+    def public_key
+      <<~KEY.strip
+        -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+        mQENBFnNgbIBCAC9/WblcR4s/pFTwh9cm2iS59YRhtGfbrnfNE6QMIFIRFaK0u6J
+        LDy+scipXLoGg7X0XNFLW6Y457UUpkaPDVLPuVMONhMXdVqndGVvk9jq3D4oDtRa
+        ukucuXr9F84lHnjL3EosmAUiK3xBmHOGHm8+bvKbgPOdvre48YxoJ1POTen+chfo
+        YtLUfnC9EEGY/bn00aaXm3NV+zZK2zio5bFX9YLWSNh/JaXxuJsLoHR/lVrU7CLt
+        FCaGcPQ9SU46LHPshEYWO7ZsjEYJsYYOIOEzfcfR47T2EDTa6mVc++gC5TCoY3Ql
+        jccgm+EM0LvyEHwupEpxzCg2VsT0yoedhUhtABEBAAG0H0pvaG4gRG9lIDxqb2hu
+        LmRvZUBleGFtcGxlLmNvbT6JAVQEEwEIAD4WIQTqP4uIlyqP1HSHLy8RWzrxqtPt
+        ugUCWc2BsgIbAwUJA8JnAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRARWzrx
+        qtPturMDCACc1Pi1sLJFcCnJEc9sCInCO4LH8fntNjRLN3MTPU5YCYmFM3fAl5ly
+        vXPZ4jNWZxKbQVeFnkDOg5Ti8bzmFEMc8KbZuguktVFizxnLdFCTTRO89i3HDVSN
+        bIosrs5HJwRKOzul6i2whn3dsr8/P8WJczYjZGiw29hGwH3md4Thn/aAGbzjoCEF
+        IfIb1kccyHMJkaj79S8B2agsbEJLuTSfsXC3kGZIJyKG1DNmDUHW/ZE6ro/Kkhik
+        3w6Jw14cMsKUIOBkOgsD/gXgX9xxWjYHmKrbCXucTKUevNlaCy5tzwrC0Am3prl9
+        OJj3macOA8hNaTVDflEHNCwHOwqnVQYyuQENBFnNgbIBCAC59MmKc0cqPRPTpCZ5
+        arKRoj23SNKWMDWaxSELdU91Wd/NJk4wF25urk9BtBuwjzaBMqb/xPD88yJC3ucs
+        2LwCyAb5C/dHcPOpys8Pd+KrdHDR3zAMjcASsizlW/qFI9MtjhcU9Yd6iTUejAZG
+        NEC76WALJ3SLYzCaDkHFjWpH3Xq6ck3/9jpL3csn/5GLCsZQUDYGrZSXvHAIigwW
+        Xo6tMs5LCCO9CZg2qGDpvqlzcmy6CRkf0h/UFYJzGqfbJtxeCIxa93WIPE8eGwao
+        aneDlNtIoYiP6krC3OLsaPWT58QltNKaQuZSpjwtQBHa4JIt55vx+FcvRb7Kflgf
+        fT8bABEBAAGJATwEGAEIACYWIQTqP4uIlyqP1HSHLy8RWzrxqtPtugUCWc2BsgIb
+        DAUJA8JnAAAKCRARWzrxqtPtuqJjCACj+Z4qtgMpJXx3u58wCzkVLl5IylD/tEPA
+        cNIrj8QS8ec+woTJaMGVCh96VC2FPl8KR4Hjhy0yaupyPbTI6VWib63S/NcDfG7r
+        tviRFG2Gf8yduERebyC0cpgnmjVgFfJs7N3K3ncz6myOr9idNI05OC9poL73sDUv
+        jRXhm7uy938bT/R4MQdpYuxucgU3MiwvfG5ht+oJ4Yp+/IrR2PTqRGqMCsodnroa
+        TBKq2kW565TtCvrFkNub/ytorDbIVN9VrIMcuTiOv8sLoQRDJO9HvWUhYAqMY6Uh
+        dy12jR9FrquZnGsDKKs9V0Y6J4Wi8vnmdgWVZUc40pfXq3APAB6suQENBFnNgeAB
+        CADFqQRxLHxLIQ7B72diTMI2tPk9d5c67k+Gzkrg1QYoxBLdRCmhM4ydYqZzvIz4
+        1npkK20w4somOCwvyAOjO46IGb3f/Wk8mY8o5HMpI1miAfze0YTZKzRo2DmrvwbV
+        /h8jvZNCISwtrOgaaszWSVSuEQQCA1jf4qixfCb3ReETvZc3MTZXhw8IUbszXh5d
+        a6CYqq/fr5Zw4Dc19ZSoHSTh0Wn03mEm/kaYtia/wt1I+xVvTSaC2Pf/kUtr7UEf
+        3NMc0YF0s4KgeW8KwjHa7Sz9wzydLPRH5kJ26SDUGUhrFf1jNLIegtDsoISV/86G
+        ztXcVq5GY6lXMwmsggRe++7xABEBAAGJAmwEGAEIACAWIQTqP4uIlyqP1HSHLy8R
+        WzrxqtPtugUCWc2B4AIbAgFACRARWzrxqtPtusB0IAQZAQgAHRYhBAUi3Sm5jxZ8
+        2EIXUuOP/K91q9kqBQJZzYHgAAoJEOOP/K91q9kqlHcH+wbvD14ITYDMfgIfy67O
+        4Qcmgf1qzGXhpsABz/i/EPgRD990eNBI0YGuvoKRJfetEGn7LerrrCB8Z+ICFPHF
+        rzXoe10zm+QTREck0OB8nPFRycJ+Fbl6JX+cnkEx27Mmg1aVb7+H5LMDaWO1KjLs
+        g2wIDo/jrDfW7NoZzy4XTd7jFCOt4fftL/dhiujQmhLzugZXCxRISOVdmgilDJQo
+        Tz1sEm34ida98JFjdzSgkUvJ/pFTZ21ThCNxlUf01Hr2Pdcg1e2/97sZocMFTY2J
+        KwmiW2LG3B05/VrRtdvsCVj8G49coxgPPKty+m71ovAXdS/CvVqE7TefCplsYJ1d
+        V3abwwf/Xl2SxzbAKbrYMgZfdGzpPg2u6982WvfGIVfjFJh9veHZAbfkPcjdAD2X
+        e67Y4BeKG2OQQqeOY2y+81A7PaehgHzbFHJG/4RjqB66efrZAg4DgIdbr4oyMoUJ
+        VVsl0wfYSIvnd4kvWXYICVwk53HLA3wIowZAsJ1LT2byAKbUzayLzTekrTzGcwQk
+        g2XT798ev2QuR5Ki5x8MULBFX4Lhd03+uGOxjhNPQD6DAAHCQLaXQhaGuyMgt5hD
+        t0nF3yuw3Eg4Ygcbtm24rZXOHJc9bDKeRiWZz1dIyYYVJmHSQwOVXkAwJlF1sIgy
+        /jQYeOgFDKq20x86WulkvsUtBoaZJg==
+        =Q5Z7
+        -----END PGP PUBLIC KEY BLOCK-----
+      KEY
+    end
+
+    def secret_key
+      <<~SECRET
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+        lQPGBFnNgbIBCAC9/WblcR4s/pFTwh9cm2iS59YRhtGfbrnfNE6QMIFIRFaK0u6J
+        LDy+scipXLoGg7X0XNFLW6Y457UUpkaPDVLPuVMONhMXdVqndGVvk9jq3D4oDtRa
+        ukucuXr9F84lHnjL3EosmAUiK3xBmHOGHm8+bvKbgPOdvre48YxoJ1POTen+chfo
+        YtLUfnC9EEGY/bn00aaXm3NV+zZK2zio5bFX9YLWSNh/JaXxuJsLoHR/lVrU7CLt
+        FCaGcPQ9SU46LHPshEYWO7ZsjEYJsYYOIOEzfcfR47T2EDTa6mVc++gC5TCoY3Ql
+        jccgm+EM0LvyEHwupEpxzCg2VsT0yoedhUhtABEBAAH+BwMCOqjIWtWBMo3mjIP1
+        OnIbZ+YJxSUZ/B8wU2loMv4XiKmeXLbjD6h3jojxYlnreSHA9QvoY8uNaWElL/n2
+        jv6bxluivk8tA9FWJVv4HaSlMDd2J2YmUW17r8z9Kvm7b7pFVSrEoYV93Wdj5FJ7
+        ciKrFhYNSD7tH1sHwkrFAbiv6aHyk9h48YmR3kx2wBvz+pWk7M2srCJx2b6DXkj/
+        fsj1c/vnzUUGooOJgOvYAWrpg/rJUNxSsFypAHf8Xtk+xt8S1aZ9jaCmYk6I1B2L
+        m00HP43cXUpKcmETW1zXvfMLKjjoUEAJhSJhbCwiEzGL4ojQTarl8qbb+MisakEJ
+        DkPYtrhiiuVzUIFfqE86yO0UKidtzBmJAW3c6zeiUATvACzU09aGyUY1cJi93oXD
+        w4PCyVZ+nMvGD1wx+gyYdDINwpX4y6od9RDr06DGCzwu+S2vxsu1T8LdSv52fhBr
+        U0FY3Z3VN1ytay4SHi/8Y9VBYQFBh7R7Ch0gEMxLVKXVNqOXHUdGrKWV/WmyLKuZ
+        W9DEnWU4Mpz/di5jU8EDW7EB9DZZhVk3mQw3nuAZrBGD4azmmD5mgSgLeBGmKZ1e
+        q/9IWO44mRBBUtNv+rAkmmYF3MCNHuc7EMj+c/IgBUC7d5qBzGWA3UJ0vKX4xcIQ
+        X/PnU+nGxNvBrdqQaMLczeg28SerojxuX79prOsoySctLAbajd9HshW5SfOZ0rvb
+        BNHPqolQDijYEHGxANh4BbamRMGi60Rop7vJsZOLAemz17x/mvCtAHISOJT77/IM
+        oWC+IksJ5XsA/klJGe/tkx11aRQDDmKvIJXmMuRdvnIR23UBbzRQlWWq0l6CdoF6
+        6SQ9BJBFq0WY32No9WZAPnDO3buUzWc1Y3uwn/+h7TVYVyTlEqzpYJ9FoJwBHbor
+        0663eoyz6+AUtB9Kb2huIERvZSA8am9obi5kb2VAZXhhbXBsZS5jb20+iQFUBBMB
+        CAA+FiEE6j+LiJcqj9R0hy8vEVs68arT7boFAlnNgbICGwMFCQPCZwAFCwkIBwIG
+        FQgJCgsCBBYCAwECHgECF4AACgkQEVs68arT7bqzAwgAnNT4tbCyRXApyRHPbAiJ
+        wjuCx/H57TY0SzdzEz1OWAmJhTN3wJeZcr1z2eIzVmcSm0FXhZ5AzoOU4vG85hRD
+        HPCm2boLpLVRYs8Zy3RQk00TvPYtxw1UjWyKLK7ORycESjs7peotsIZ93bK/Pz/F
+        iXM2I2RosNvYRsB95neE4Z/2gBm846AhBSHyG9ZHHMhzCZGo+/UvAdmoLGxCS7k0
+        n7Fwt5BmSCcihtQzZg1B1v2ROq6PypIYpN8OicNeHDLClCDgZDoLA/4F4F/ccVo2
+        B5iq2wl7nEylHrzZWgsubc8KwtAJt6a5fTiY95mnDgPITWk1Q35RBzQsBzsKp1UG
+        Mp0DxgRZzYGyAQgAufTJinNHKj0T06QmeWqykaI9t0jSljA1msUhC3VPdVnfzSZO
+        MBdubq5PQbQbsI82gTKm/8Tw/PMiQt7nLNi8AsgG+Qv3R3DzqcrPD3fiq3Rw0d8w
+        DI3AErIs5Vv6hSPTLY4XFPWHeok1HowGRjRAu+lgCyd0i2Mwmg5BxY1qR916unJN
+        //Y6S93LJ/+RiwrGUFA2Bq2Ul7xwCIoMFl6OrTLOSwgjvQmYNqhg6b6pc3JsugkZ
+        H9If1BWCcxqn2ybcXgiMWvd1iDxPHhsGqGp3g5TbSKGIj+pKwtzi7Gj1k+fEJbTS
+        mkLmUqY8LUAR2uCSLeeb8fhXL0W+yn5YH30/GwARAQAB/gcDAuYn/gmAA3OC5p5Q
+        Pat5kE7MtmSvSPmdjVA2o+6RtqZf81JqtAgtDVDwj7SPFsH6ue5P+iAn9938YYek
+        WQU2+0GXeUbSJt+u4VAchgwA5mYsEnEr1/E5KEfWPWO3jJol1rJG99adrjkMxvug
+        QJmwieqhu0368w1FU0tKstxYbr3Tz3nPCPDJoigMEUkXiFklDCUgeNk0g+zd5ytE
+        lXuuLYcGZX7njxL5jD+cMIKqua5zv8WbvNf/BhM1nCarxp4qzKWim8J8jY+iR+/E
+        qOar4aliGRez0j+qh/r8ywgPwfOO89zrKrMfaclL7dN9yuecmBHKWZvfrP5JKMHj
+        yTU3nRMhUGbfVUaaZI2Ccz2rNOU4oF9wuzpzQi8qOysZixRmH61Nw3ULIKoQgiWp
+        0p5A3L94OaEfZEq3plVaIXI2YWYFSEAlIAc2dq4GxynousLdhNACi9bHhXrfFUhK
+        ckw1QlbhguO/j63/x8ygsmLZVwHG0fJZtMhT3+EGam9cuMBibIYyu3ufJRy7kMKt
+        kmyuk02X+hYJ7w8Pu6b8zYHBXbsEKamipMgd4oKtc8WnXILZo4lwDSArgs7ZVCBa
+        vGBbpTOsr54WjsyuCdX/wv0F2l31J87UxVtTKXx/+nfMfCE02zd+NsTgqvgqmkaA
+        Sy3qvv326kJNx7p+5hRwDzlAZ7vGJjj5TwCbGYDvctIf6MFrGDRNYwrGwNkPc3TG
+        rturfeL/ioua0Smj8LIbOv9Ir93gUIseNpxv8tXV/lffdIplcw802b3aXIKyv4fq
+        b9y3Oq/pDHFukKuBe9WTXJvjT0+ME+a0C8KIb/sts95pmjZsgN1kPmvuT0ReQwUR
+        eGrqz387bnVUzo4RgM3IERs/0EYzPzE8A2vc1e4/87b5J+1Xnov8Phd29vW8Td5l
+        ApiFrFO2r+/Np4kBPAQYAQgAJhYhBOo/i4iXKo/UdIcvLxFbOvGq0+26BQJZzYGy
+        AhsMBQkDwmcAAAoJEBFbOvGq0+26omMIAKP5niq2AyklfHe7nzALORUuXkjKUP+0
+        Q8Bw0iuPxBLx5z7ChMlowZUKH3pULYU+XwpHgeOHLTJq6nI9tMjpVaJvrdL81wN8
+        buu2+JEUbYZ/zJ24RF5vILRymCeaNWAV8mzs3credzPqbI6v2J00jTk4L2mgvvew
+        NS+NFeGbu7L3fxtP9HgxB2li7G5yBTcyLC98bmG36gnhin78itHY9OpEaowKyh2e
+        uhpMEqraRbnrlO0K+sWQ25v/K2isNshU31Wsgxy5OI6/ywuhBEMk70e9ZSFgCoxj
+        pSF3LXaNH0Wuq5mcawMoqz1XRjonhaLy+eZ2BZVlRzjSl9ercA8AHqydA8YEWc2B
+        4AEIAMWpBHEsfEshDsHvZ2JMwja0+T13lzruT4bOSuDVBijEEt1EKaEzjJ1ipnO8
+        jPjWemQrbTDiyiY4LC/IA6M7jogZvd/9aTyZjyjkcykjWaIB/N7RhNkrNGjYOau/
+        BtX+HyO9k0IhLC2s6BpqzNZJVK4RBAIDWN/iqLF8JvdF4RO9lzcxNleHDwhRuzNe
+        Hl1roJiqr9+vlnDgNzX1lKgdJOHRafTeYSb+Rpi2Jr/C3Uj7FW9NJoLY9/+RS2vt
+        QR/c0xzRgXSzgqB5bwrCMdrtLP3DPJ0s9EfmQnbpINQZSGsV/WM0sh6C0OyghJX/
+        zobO1dxWrkZjqVczCayCBF777vEAEQEAAf4HAwKESvCIDq5QNeadnSvpkZemItPO
+        lDf+7Wiue2gt776D5xkVyT7WkgTQv+IGWGtqz7pCCO2rMp/F9u1BghdjY46jtrK6
+        MMFKta4YENUhRliH6M2YmRjq5p7xZgH6UOnDlqsafbfyUx30t59tbQj+07aMnH5J
+        LMm37nVkDvo3wpPQPuo7L6qizYsrHrQKeJZ8636u41UjC99lVH7vXzqXw68FJImi
+        XdMZbEVBIprYfCDem+fD6gJBA4JBqWJMxuFMfhWp+1WtYoeNojDm4KxBzc2fvYV/
+        HOIUfLFBvACD/UwU5ovllHN39/O8SMgyLm9ymx2/qXcdIkUz4l7fhOCY1OW12DMu
+        5OFrrTteGK/Sj4Z8pYRdMdaKyjIlxuVzEQGWsU5+J2ALao5atEHguqwlD3cKh3G8
+        1sA/l5eTFDt84erYv1MVStV0BhZaCE4mNL4WpnQGDdW05yoGq9jIyLcurb/k/atU
+        TUkAF1csgNlJlR3IP+7U9xfHkjMO5+SV82xoNf9nBjz06TRdnvOSKsMNKp0RxC/L
+        Hbiee9o7Rxqdiyv0ly6bCCymwfvlsEIqo3YKssBfe3XI5yQI2hF9QZaH1ywzmgaH
+        o+rbME/XxddRJueS79eipT7K05Z3ulSHTXzpDw+jZcdUV0Ac72Q9FTDPMl3xc6NW
+        DrYwWw/3+kyZ4SkP56l7KlGczTyNPvU9iou4Cj/cAZk/pHx68Chq8ZZNznFm/bIF
+        gWt3fqE/n+y78B6MI8qTjGJOR0jycxrLH82Z2F+FpMShI2C5NnOa/Ilkv3e2Q5U6
+        MOAwaCIz6RHhcI99O/yta2vLelWZqn2g86rLzTG0HlIABTCPYotwetHh0hsrkSv9
+        Kh6rOzGB4i8lRqcBVY+alMSiRBlzkwpL4YUcO6f3vEDncQ9evE1AQCpD4jUJjB1H
+        JSSJAmwEGAEIACAWIQTqP4uIlyqP1HSHLy8RWzrxqtPtugUCWc2B4AIbAgFACRAR
+        WzrxqtPtusB0IAQZAQgAHRYhBAUi3Sm5jxZ82EIXUuOP/K91q9kqBQJZzYHgAAoJ
+        EOOP/K91q9kqlHcH+wbvD14ITYDMfgIfy67O4Qcmgf1qzGXhpsABz/i/EPgRD990
+        eNBI0YGuvoKRJfetEGn7LerrrCB8Z+ICFPHFrzXoe10zm+QTREck0OB8nPFRycJ+
+        Fbl6JX+cnkEx27Mmg1aVb7+H5LMDaWO1KjLsg2wIDo/jrDfW7NoZzy4XTd7jFCOt
+        4fftL/dhiujQmhLzugZXCxRISOVdmgilDJQoTz1sEm34ida98JFjdzSgkUvJ/pFT
+        Z21ThCNxlUf01Hr2Pdcg1e2/97sZocMFTY2JKwmiW2LG3B05/VrRtdvsCVj8G49c
+        oxgPPKty+m71ovAXdS/CvVqE7TefCplsYJ1dV3abwwf/Xl2SxzbAKbrYMgZfdGzp
+        Pg2u6982WvfGIVfjFJh9veHZAbfkPcjdAD2Xe67Y4BeKG2OQQqeOY2y+81A7Paeh
+        gHzbFHJG/4RjqB66efrZAg4DgIdbr4oyMoUJVVsl0wfYSIvnd4kvWXYICVwk53HL
+        A3wIowZAsJ1LT2byAKbUzayLzTekrTzGcwQkg2XT798ev2QuR5Ki5x8MULBFX4Lh
+        d03+uGOxjhNPQD6DAAHCQLaXQhaGuyMgt5hDt0nF3yuw3Eg4Ygcbtm24rZXOHJc9
+        bDKeRiWZz1dIyYYVJmHSQwOVXkAwJlF1sIgy/jQYeOgFDKq20x86WulkvsUtBoaZ
+        Jg==
+        =TKlF
+        -----END PGP PRIVATE KEY BLOCK-----
+      SECRET
+    end
+
+    def fingerprint
+      'EA3F8B88972A8FD474872F2F115B3AF1AAD3EDBA'
+    end
+
+    def subkey_fingerprints
+      %w(159AD5DDF199591D67D2B87AA3CEC5C0A7C270EC 0522DD29B98F167CD8421752E38FFCAF75ABD92A)
+    end
+
+    def names
+      ['John Doe']
+    end
+
+    def emails
+      ['john.doe@example.com']
+    end
+  end
 end
-- 
cgit v1.2.1


From 59f813998237a3840fd019ef7c552e86f2753dff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 28 Sep 2017 20:16:53 -0500
Subject: Remove unused association

---
 app/models/gpg_key.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index e6c862d9b55..0ddf1245dd1 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -8,7 +8,6 @@ class GpgKey < ActiveRecord::Base
   sha_attribute :fingerprint
 
   belongs_to :user
-  belongs_to :parent, class_name: 'GpgKey'
   has_many :gpg_signatures
   has_many :subkeys, class_name: 'GpgKeySubkey'
 
-- 
cgit v1.2.1


From c2c35ae7971d19396078bdec6474fdd58f66000c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Fri, 29 Sep 2017 00:24:03 -0500
Subject: Consider GPG subkeys when trying to update invalid GPG signatures

---
 lib/gitlab/gpg/invalid_gpg_signature_updater.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
index e085eab26c9..9bad914848d 100644
--- a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
+++ b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
@@ -3,13 +3,14 @@ module Gitlab
     class InvalidGpgSignatureUpdater
       def initialize(gpg_key)
         @gpg_key = gpg_key
+        @gpg_keyids = gpg_key.subkeys.map(&:keyid).push(gpg_key.primary_keyid)
       end
 
       def run
         GpgSignature
           .select(:id, :commit_sha, :project_id)
           .where('gpg_key_id IS NULL OR verification_status <> ?', GpgSignature.verification_statuses[:verified])
-          .where(gpg_key_primary_keyid: @gpg_key.primary_keyid)
+          .where(gpg_key_primary_keyid: @gpg_keyids)
           .find_each { |sig| sig.gpg_commit.update_signature!(sig) }
       end
     end
-- 
cgit v1.2.1


From c50725fecfb776d56c95ef070940ca6c85786ecf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Fri, 29 Sep 2017 17:55:36 -0500
Subject: Address feedback from last code review

---
 app/models/gpg_key.rb                           |  5 +++++
 app/models/gpg_key_subkey.rb                    |  3 +++
 app/models/gpg_signature.rb                     |  2 +-
 lib/gitlab/gpg.rb                               | 11 +++++------
 lib/gitlab/gpg/commit.rb                        |  8 +-------
 lib/gitlab/gpg/invalid_gpg_signature_updater.rb |  3 +--
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 0ddf1245dd1..27513f4b03f 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -44,6 +44,7 @@ class GpgKey < ActiveRecord::Base
   def primary_keyid
     super&.upcase
   end
+  alias_method :keyid, :primary_keyid
 
   def fingerprint
     super&.upcase
@@ -53,6 +54,10 @@ class GpgKey < ActiveRecord::Base
     super(value&.strip)
   end
 
+  def keyids
+    [keyid].concat(subkeys.map(&:keyid))
+  end
+
   def user_infos
     @user_infos ||= Gitlab::Gpg.user_infos_from_key(key)
   end
diff --git a/app/models/gpg_key_subkey.rb b/app/models/gpg_key_subkey.rb
index b4f146e5647..1f3ec2a8f68 100644
--- a/app/models/gpg_key_subkey.rb
+++ b/app/models/gpg_key_subkey.rb
@@ -9,6 +9,9 @@ class GpgKeySubkey < ActiveRecord::Base
   validates :gpg_key_id, presence: true
   validates :fingerprint, :keyid, presence: true, uniqueness: true
 
+  delegate :key, :user, :user_infos, :verified?, :verified_user_infos,
+    :verified_and_belongs_to_email?, to: :gpg_key
+
   def keyid
     super&.upcase
   end
diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index c7f75288407..d3cca19cea8 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -24,7 +24,7 @@ class GpgSignature < ActiveRecord::Base
   def gpg_key=(model)
     case model
     when GpgKey       then super
-    when GpgKeySubkey then write_attribute(:gpg_key_subkey_id, model.id)
+    when GpgKeySubkey then self.gpg_key_subkey = model
     end
   end
 
diff --git a/lib/gitlab/gpg.rb b/lib/gitlab/gpg.rb
index 343bf54a6ae..413872d7e08 100644
--- a/lib/gitlab/gpg.rb
+++ b/lib/gitlab/gpg.rb
@@ -36,15 +36,14 @@ module Gitlab
 
     def subkeys_from_key(key)
       using_tmp_keychain do
-        fingerprints    = CurrentKeyChain.fingerprints_from_key(key)
-        raw_keys        = GPGME::Key.find(:public, fingerprints)
-        grouped_subkeys = Hash.new { |h, k| h[k] = [] }
+        fingerprints = CurrentKeyChain.fingerprints_from_key(key)
+        raw_keys     = GPGME::Key.find(:public, fingerprints)
 
-        raw_keys.each_with_object(grouped_subkeys).each do |raw_key, subkeys|
+        raw_keys.each_with_object({}) do |raw_key, grouped_subkeys|
           primary_subkey_id = raw_key.primary_subkey.keyid
 
-          raw_key.subkeys[1..-1].each do |subkey|
-            subkeys[primary_subkey_id] << { keyid: subkey.keyid, fingerprint: subkey.fingerprint }
+          grouped_subkeys[primary_subkey_id] = raw_key.subkeys[1..-1].map do |s|
+            { keyid: s.keyid, fingerprint: s.fingerprint }
           end
         end
       end
diff --git a/lib/gitlab/gpg/commit.rb b/lib/gitlab/gpg/commit.rb
index 5cbc836314f..961c57ec0e6 100644
--- a/lib/gitlab/gpg/commit.rb
+++ b/lib/gitlab/gpg/commit.rb
@@ -74,7 +74,7 @@ module Gitlab
           commit_sha: @commit.sha,
           project: @commit.project,
           gpg_key: gpg_key,
-          gpg_key_primary_keyid: gpg_keyid(gpg_key) || verified_signature.fingerprint,
+          gpg_key_primary_keyid: gpg_key&.keyid || verified_signature.fingerprint,
           gpg_key_user_name: user_infos[:name],
           gpg_key_user_email: user_infos[:email],
           verification_status: verification_status
@@ -99,12 +99,6 @@ module Gitlab
         gpg_key&.verified_user_infos&.first || gpg_key&.user_infos&.first || {}
       end
 
-      def gpg_keyid(gpg_key)
-        return nil unless gpg_key
-
-        gpg_key.is_a?(GpgKey) ? gpg_key.primary_keyid : gpg_key.keyid
-      end
-
       def find_gpg_key(keyid)
         GpgKey.find_by(primary_keyid: keyid) || GpgKeySubkey.find_by(keyid: keyid)
       end
diff --git a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
index 9bad914848d..b7fb9dde2bc 100644
--- a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
+++ b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
@@ -3,14 +3,13 @@ module Gitlab
     class InvalidGpgSignatureUpdater
       def initialize(gpg_key)
         @gpg_key = gpg_key
-        @gpg_keyids = gpg_key.subkeys.map(&:keyid).push(gpg_key.primary_keyid)
       end
 
       def run
         GpgSignature
           .select(:id, :commit_sha, :project_id)
           .where('gpg_key_id IS NULL OR verification_status <> ?', GpgSignature.verification_statuses[:verified])
-          .where(gpg_key_primary_keyid: @gpg_keyids)
+          .where(gpg_key_primary_keyid: @gpg_key.keyids)
           .find_each { |sig| sig.gpg_commit.update_signature!(sig) }
       end
     end
-- 
cgit v1.2.1


From 85c6652a387276ca58b900fa34948cf3cba489a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Sun, 1 Oct 2017 21:50:38 -0500
Subject: Fix some broken specs

---
 app/models/gpg_key.rb             | 2 +-
 spec/factories/gpg_key_subkeys.rb | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 27513f4b03f..145b957fc88 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -119,7 +119,7 @@ class GpgKey < ActiveRecord::Base
   def generate_subkeys
     gpg_subkeys = Gitlab::Gpg.subkeys_from_key(key)
 
-    gpg_subkeys[primary_keyid].each do |subkey_data|
+    gpg_subkeys[primary_keyid]&.each do |subkey_data|
       subkeys.create!(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
     end
   end
diff --git a/spec/factories/gpg_key_subkeys.rb b/spec/factories/gpg_key_subkeys.rb
index d896b4e217e..66ecb44d84b 100644
--- a/spec/factories/gpg_key_subkeys.rb
+++ b/spec/factories/gpg_key_subkeys.rb
@@ -4,7 +4,7 @@ FactoryGirl.define do
   factory :gpg_key_subkey do
     gpg_key
 
-    keyid { gpg_key.subkeys.last.keyid }
-    fingerprint { gpg_key.subkeys.last.fingerprint }
+    sequence(:keyid) { |n| "keyid-#{n}" }
+    sequence(:fingerprint) { |n| "fingerprint-#{n}" }
   end
 end
-- 
cgit v1.2.1


From ecfe6292d3a5d40d7179cf763fb60cf73adb30e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Mon, 2 Oct 2017 20:46:19 -0500
Subject: Add migration to generate GpgKeySubkeys records and update signatures

---
 ...create_gpg_key_subkeys_for_existing_gpg_keys.rb | 59 ++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb

diff --git a/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
new file mode 100644
index 00000000000..355fbfbbede
--- /dev/null
+++ b/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
@@ -0,0 +1,59 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
+  disable_ddl_transaction!
+
+  DOWNTIME = false
+
+  class GpgKey < ActiveRecord::Base
+    self.table_name = 'gpg_keys'
+
+    include EachBatch
+    include ShaAttribute
+
+    sha_attribute :primary_keyid
+    sha_attribute :fingerprint
+
+    has_many :subkeys, class_name: 'GpgKeySubkey'
+  end
+
+  class GpgKeySubkey < ActiveRecord::Base
+    self.table_name = 'gpg_key_subkeys'
+
+    include ShaAttribute
+
+    sha_attribute :keyid
+    sha_attribute :fingerprint
+  end
+
+  def up
+    GpgKey.each_batch do |batch|
+      batch.each do |gpg_key|
+        create_subkeys(gpg_key) && update_signatures(gpg_key)
+      end
+    end
+  end
+
+  def down
+  end
+
+  private
+
+  def create_subkeys(gpg_key)
+    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(gpg_key.key)
+
+    gpg_subkeys[gpg_key.primary_keyid.upcase]&.each do |subkey_data|
+      gpg_key.subkeys.build(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
+    end
+
+    # Improve latency by doing all INSERTs in a single call
+    GpgKey.transaction do
+      gpg_key.save!
+    end
+  end
+
+  def update_signatures(gpg_key)
+    InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
+  end
+end
-- 
cgit v1.2.1


From 8b0397041866c0e2bcbf4c462100fc681d96f893 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Mon, 2 Oct 2017 20:51:49 -0500
Subject: Add CHANGELOG entry

---
 changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys

diff --git a/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys b/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys
new file mode 100644
index 00000000000..ee6a7287e86
--- /dev/null
+++ b/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys
@@ -0,0 +1,5 @@
+---
+title: Add support for GPG subkeys in signature verification
+merge_request: 14517
+author:
+type: added
-- 
cgit v1.2.1


From 8d296b62e4534820feb94cfe0d8b5d3e34f6ee33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Mon, 2 Oct 2017 21:08:59 -0500
Subject: Convert migration to a post deployment migration

This migration can take a bit of time to complete and I don't want to
delay the deployment process.
---
 ...create_gpg_key_subkeys_for_existing_gpg_keys.rb | 59 ----------------------
 ...create_gpg_key_subkeys_for_existing_gpg_keys.rb | 59 ++++++++++++++++++++++
 2 files changed, 59 insertions(+), 59 deletions(-)
 delete mode 100644 db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
 create mode 100644 db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb

diff --git a/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
deleted file mode 100644
index 355fbfbbede..00000000000
--- a/db/migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
+++ /dev/null
@@ -1,59 +0,0 @@
-# See http://doc.gitlab.com/ce/development/migration_style_guide.html
-# for more information on how to write migrations for GitLab.
-
-class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
-  disable_ddl_transaction!
-
-  DOWNTIME = false
-
-  class GpgKey < ActiveRecord::Base
-    self.table_name = 'gpg_keys'
-
-    include EachBatch
-    include ShaAttribute
-
-    sha_attribute :primary_keyid
-    sha_attribute :fingerprint
-
-    has_many :subkeys, class_name: 'GpgKeySubkey'
-  end
-
-  class GpgKeySubkey < ActiveRecord::Base
-    self.table_name = 'gpg_key_subkeys'
-
-    include ShaAttribute
-
-    sha_attribute :keyid
-    sha_attribute :fingerprint
-  end
-
-  def up
-    GpgKey.each_batch do |batch|
-      batch.each do |gpg_key|
-        create_subkeys(gpg_key) && update_signatures(gpg_key)
-      end
-    end
-  end
-
-  def down
-  end
-
-  private
-
-  def create_subkeys(gpg_key)
-    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(gpg_key.key)
-
-    gpg_subkeys[gpg_key.primary_keyid.upcase]&.each do |subkey_data|
-      gpg_key.subkeys.build(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
-    end
-
-    # Improve latency by doing all INSERTs in a single call
-    GpgKey.transaction do
-      gpg_key.save!
-    end
-  end
-
-  def update_signatures(gpg_key)
-    InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
-  end
-end
diff --git a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
new file mode 100644
index 00000000000..355fbfbbede
--- /dev/null
+++ b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
@@ -0,0 +1,59 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
+  disable_ddl_transaction!
+
+  DOWNTIME = false
+
+  class GpgKey < ActiveRecord::Base
+    self.table_name = 'gpg_keys'
+
+    include EachBatch
+    include ShaAttribute
+
+    sha_attribute :primary_keyid
+    sha_attribute :fingerprint
+
+    has_many :subkeys, class_name: 'GpgKeySubkey'
+  end
+
+  class GpgKeySubkey < ActiveRecord::Base
+    self.table_name = 'gpg_key_subkeys'
+
+    include ShaAttribute
+
+    sha_attribute :keyid
+    sha_attribute :fingerprint
+  end
+
+  def up
+    GpgKey.each_batch do |batch|
+      batch.each do |gpg_key|
+        create_subkeys(gpg_key) && update_signatures(gpg_key)
+      end
+    end
+  end
+
+  def down
+  end
+
+  private
+
+  def create_subkeys(gpg_key)
+    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(gpg_key.key)
+
+    gpg_subkeys[gpg_key.primary_keyid.upcase]&.each do |subkey_data|
+      gpg_key.subkeys.build(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
+    end
+
+    # Improve latency by doing all INSERTs in a single call
+    GpgKey.transaction do
+      gpg_key.save!
+    end
+  end
+
+  def update_signatures(gpg_key)
+    InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
+  end
+end
-- 
cgit v1.2.1


From 8be06f20fc64b027911ad75e05afaf0697444d6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Mon, 2 Oct 2017 21:14:44 -0500
Subject: Remove no longer required methods

---
 app/models/gpg_key_subkey.rb | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/app/models/gpg_key_subkey.rb b/app/models/gpg_key_subkey.rb
index 1f3ec2a8f68..b57922aba30 100644
--- a/app/models/gpg_key_subkey.rb
+++ b/app/models/gpg_key_subkey.rb
@@ -19,14 +19,4 @@ class GpgKeySubkey < ActiveRecord::Base
   def fingerprint
     super&.upcase
   end
-
-  def method_missing(m, *a, &b)
-    return super unless gpg_key.respond_to?(m)
-
-    gpg_key.public_send(m, *a, &b) # rubocop:disable GitlabSecurity/PublicSend
-  end
-
-  def respond_to_missing?(method, include_private = false)
-    gpg_key.respond_to?(method, include_private) || super
-  end
 end
-- 
cgit v1.2.1


From 2577cc99818bd0332aa78018de666579971341c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 4 Oct 2017 10:34:50 -0500
Subject: Address some feedback from last code review

---
 app/models/gpg_signature.rb                                      | 9 +++++++--
 changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys    | 5 -----
 .../unreleased/36829-add-ability-to-verify-gpg-subkeys.yml       | 5 +++++
 db/migrate/20170927161718_create_gpg_key_subkeys.rb              | 4 ++--
 ...0171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb | 4 +++-
 db/schema.rb                                                     | 2 +-
 lib/gitlab/gpg/commit.rb                                         | 2 ++
 7 files changed, 20 insertions(+), 11 deletions(-)
 delete mode 100644 changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys
 create mode 100644 changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys.yml

diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index d3cca19cea8..e783c3b24e4 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -23,8 +23,13 @@ class GpgSignature < ActiveRecord::Base
 
   def gpg_key=(model)
     case model
-    when GpgKey       then super
-    when GpgKeySubkey then self.gpg_key_subkey = model
+    when GpgKey
+      super
+    when GpgKeySubkey
+      self.gpg_key_subkey = model
+    when NilClass
+      super
+      self.gpg_key_subkey = nil
     end
   end
 
diff --git a/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys b/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys
deleted file mode 100644
index ee6a7287e86..00000000000
--- a/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: Add support for GPG subkeys in signature verification
-merge_request: 14517
-author:
-type: added
diff --git a/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys.yml b/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys.yml
new file mode 100644
index 00000000000..ee6a7287e86
--- /dev/null
+++ b/changelogs/unreleased/36829-add-ability-to-verify-gpg-subkeys.yml
@@ -0,0 +1,5 @@
+---
+title: Add support for GPG subkeys in signature verification
+merge_request: 14517
+author:
+type: added
diff --git a/db/migrate/20170927161718_create_gpg_key_subkeys.rb b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
index ffe06ce1231..c03c40416a8 100644
--- a/db/migrate/20170927161718_create_gpg_key_subkeys.rb
+++ b/db/migrate/20170927161718_create_gpg_key_subkeys.rb
@@ -3,11 +3,11 @@ class CreateGpgKeySubkeys < ActiveRecord::Migration
 
   def up
     create_table :gpg_key_subkeys do |t|
+      t.references :gpg_key, null: false, index: true, foreign_key: { on_delete: :cascade }
+
       t.binary :keyid
       t.binary :fingerprint
 
-      t.references :gpg_key, null: false, index: true, foreign_key: { on_delete: :cascade }
-
       t.index :keyid, unique: true, length: Gitlab::Database.mysql? ? 20 : nil
       t.index :fingerprint, unique: true, length: Gitlab::Database.mysql? ? 20 : nil
     end
diff --git a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
index 355fbfbbede..346dfb1a4b6 100644
--- a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
+++ b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
@@ -28,8 +28,10 @@ class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
   end
 
   def up
-    GpgKey.each_batch do |batch|
+    GpgKey.with_subkeys.each_batch do |batch|
       batch.each do |gpg_key|
+        return if gpg_key.subkeys.any?
+
         create_subkeys(gpg_key) && update_signatures(gpg_key)
       end
     end
diff --git a/db/schema.rb b/db/schema.rb
index b9de70b742a..3bcfbcc3fd1 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -580,9 +580,9 @@ ActiveRecord::Schema.define(version: 20171004121444) do
   add_index "forked_project_links", ["forked_to_project_id"], name: "index_forked_project_links_on_forked_to_project_id", unique: true, using: :btree
 
   create_table "gpg_key_subkeys", force: :cascade do |t|
+    t.integer "gpg_key_id", null: false
     t.binary "keyid"
     t.binary "fingerprint"
-    t.integer "gpg_key_id", null: false
   end
 
   add_index "gpg_key_subkeys", ["fingerprint"], name: "index_gpg_key_subkeys_on_fingerprint", unique: true, using: :btree
diff --git a/lib/gitlab/gpg/commit.rb b/lib/gitlab/gpg/commit.rb
index 961c57ec0e6..0f4ba6f83fc 100644
--- a/lib/gitlab/gpg/commit.rb
+++ b/lib/gitlab/gpg/commit.rb
@@ -43,6 +43,8 @@ module Gitlab
           # key belonging to the keyid.
           # This way we can add the key to the temporary keychain and extract
           # the proper signature.
+          # NOTE: the invoked method is #fingerprint but it's only returning
+          # 16 characters (the format used by keyid) instead of 40.
           gpg_key = find_gpg_key(verified_signature.fingerprint)
 
           if gpg_key
-- 
cgit v1.2.1


From dd139e65b53f30eae2d8bb50dff180e8eab11fe4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Wed, 4 Oct 2017 18:44:49 -0500
Subject: Invalidate GpgSignatures associated to GpgKeySubkeys when revoking
 the GpgKey

---
 app/models/gpg_key.rb                              |  3 ++-
 app/models/gpg_signature.rb                        | 13 +++++++++++
 ...create_gpg_key_subkeys_for_existing_gpg_keys.rb |  2 +-
 spec/factories/gpg_signature.rb                    |  2 +-
 spec/models/gpg_key_spec.rb                        | 24 +++++++++++++++++++++
 spec/models/gpg_signature_spec.rb                  | 25 ++++++++++++++++++++++
 6 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/app/models/gpg_key.rb b/app/models/gpg_key.rb
index 145b957fc88..44eda741679 100644
--- a/app/models/gpg_key.rb
+++ b/app/models/gpg_key.rb
@@ -91,10 +91,11 @@ class GpgKey < ActiveRecord::Base
 
   def revoke
     GpgSignature
-      .where(gpg_key: self)
+      .with_key_and_subkeys(self)
       .where.not(verification_status: GpgSignature.verification_statuses[:unknown_key])
       .update_all(
         gpg_key_id: nil,
+        gpg_key_subkey_id: nil,
         verification_status: GpgSignature.verification_statuses[:unknown_key],
         updated_at: Time.zone.now
       )
diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index e783c3b24e4..b718e8e1000 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -21,6 +21,19 @@ class GpgSignature < ActiveRecord::Base
   validates :project_id, presence: true
   validates :gpg_key_primary_keyid, presence: true
 
+  def self.with_key_and_subkeys(gpg_key)
+    return none unless gpg_key
+
+    t = arel_table
+    subkey_ids = gpg_key&.subkeys&.pluck(:id)
+
+    where(
+      t[:gpg_key_id].eq(gpg_key&.id).or(
+        t[:gpg_key_subkey_id].in(subkey_ids)
+      )
+    )
+  end
+
   def gpg_key=(model)
     case model
     when GpgKey
diff --git a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
index 346dfb1a4b6..04c81ea684f 100644
--- a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
+++ b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
@@ -30,7 +30,7 @@ class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
   def up
     GpgKey.with_subkeys.each_batch do |batch|
       batch.each do |gpg_key|
-        return if gpg_key.subkeys.any?
+        next if gpg_key.subkeys.any?
 
         create_subkeys(gpg_key) && update_signatures(gpg_key)
       end
diff --git a/spec/factories/gpg_signature.rb b/spec/factories/gpg_signature.rb
index c0beecf0bea..e9798ff6a41 100644
--- a/spec/factories/gpg_signature.rb
+++ b/spec/factories/gpg_signature.rb
@@ -5,7 +5,7 @@ FactoryGirl.define do
     commit_sha { Digest::SHA1.hexdigest(SecureRandom.hex) }
     project
     gpg_key
-    gpg_key_primary_keyid { gpg_key.primary_keyid }
+    gpg_key_primary_keyid { gpg_key.keyid }
     verification_status :verified
   end
 end
diff --git a/spec/models/gpg_key_spec.rb b/spec/models/gpg_key_spec.rb
index 69d6090e034..33e6f1de3d1 100644
--- a/spec/models/gpg_key_spec.rb
+++ b/spec/models/gpg_key_spec.rb
@@ -191,5 +191,29 @@ describe GpgKey do
 
       expect(unrelated_gpg_key.destroyed?).to be false
     end
+
+    it 'deletes all the associated subkeys' do
+      gpg_key = create :gpg_key, key: GpgHelpers::User3.public_key
+
+      expect(gpg_key.subkeys).to be_present
+
+      gpg_key.revoke
+
+      expect(gpg_key.subkeys(true)).to be_blank
+    end
+
+    it 'invalidates all signatures associated to the subkeys' do
+      gpg_key = create :gpg_key, key: GpgHelpers::User3.public_key
+      gpg_key_subkey = gpg_key.subkeys.last
+      gpg_signature = create :gpg_signature, verification_status: :verified, gpg_key: gpg_key_subkey
+
+      gpg_key.revoke
+
+      expect(gpg_signature.reload).to have_attributes(
+        verification_status: 'unknown_key',
+        gpg_key: nil,
+        gpg_key_subkey: nil
+      )
+    end
   end
 end
diff --git a/spec/models/gpg_signature_spec.rb b/spec/models/gpg_signature_spec.rb
index 91d4efe8e2b..db033016c37 100644
--- a/spec/models/gpg_signature_spec.rb
+++ b/spec/models/gpg_signature_spec.rb
@@ -1,6 +1,9 @@
 require 'rails_helper'
 
 RSpec.describe GpgSignature do
+  let(:gpg_key) { create(:gpg_key) }
+  let(:gpg_key_subkey) { create(:gpg_key_subkey) }
+
   describe 'associations' do
     it { is_expected.to belong_to(:project) }
     it { is_expected.to belong_to(:gpg_key) }
@@ -26,4 +29,26 @@ RSpec.describe GpgSignature do
       gpg_signature.commit
     end
   end
+
+  describe '#gpg_key=' do
+    it 'supports the assignment of a GpgKey' do
+      gpg_signature = create(:gpg_signature, gpg_key: gpg_key)
+
+      expect(gpg_signature.gpg_key).to be_an_instance_of(GpgKey)
+    end
+
+    it 'supports the assignment of a GpgKeySubkey' do
+      gpg_signature = create(:gpg_signature, gpg_key: gpg_key_subkey)
+
+      expect(gpg_signature.gpg_key).to be_an_instance_of(GpgKeySubkey)
+    end
+
+    it 'clears gpg_key and gpg_key_subkey_id when passing nil' do
+      gpg_signature = create(:gpg_signature, gpg_key: gpg_key_subkey)
+      gpg_signature.update_attribute(:gpg_key, nil)
+
+      expect(gpg_signature.gpg_key_id).to be_nil
+      expect(gpg_signature.gpg_key_subkey_id).to be_nil
+    end
+  end
 end
-- 
cgit v1.2.1


From 6e0a4fc10e745f8d8be65f8ee420c75d36057c16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 5 Oct 2017 08:14:34 -0500
Subject: Convert migrations to generate subkeys to a background migration

---
 ...create_gpg_key_subkeys_for_existing_gpg_keys.rb | 61 ----------------------
 ...chedule_create_gpg_key_subkeys_from_gpg_keys.rb | 25 +++++++++
 db/schema.rb                                       |  2 +-
 .../create_gpg_key_subkeys_from_gpg_keys.rb        | 50 ++++++++++++++++++
 4 files changed, 76 insertions(+), 62 deletions(-)
 delete mode 100644 db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
 create mode 100644 db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
 create mode 100644 lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb

diff --git a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb b/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
deleted file mode 100644
index 04c81ea684f..00000000000
--- a/db/post_migrate/20171002161539_create_gpg_key_subkeys_for_existing_gpg_keys.rb
+++ /dev/null
@@ -1,61 +0,0 @@
-# See http://doc.gitlab.com/ce/development/migration_style_guide.html
-# for more information on how to write migrations for GitLab.
-
-class CreateGpgKeySubkeysForExistingGpgKeys < ActiveRecord::Migration
-  disable_ddl_transaction!
-
-  DOWNTIME = false
-
-  class GpgKey < ActiveRecord::Base
-    self.table_name = 'gpg_keys'
-
-    include EachBatch
-    include ShaAttribute
-
-    sha_attribute :primary_keyid
-    sha_attribute :fingerprint
-
-    has_many :subkeys, class_name: 'GpgKeySubkey'
-  end
-
-  class GpgKeySubkey < ActiveRecord::Base
-    self.table_name = 'gpg_key_subkeys'
-
-    include ShaAttribute
-
-    sha_attribute :keyid
-    sha_attribute :fingerprint
-  end
-
-  def up
-    GpgKey.with_subkeys.each_batch do |batch|
-      batch.each do |gpg_key|
-        next if gpg_key.subkeys.any?
-
-        create_subkeys(gpg_key) && update_signatures(gpg_key)
-      end
-    end
-  end
-
-  def down
-  end
-
-  private
-
-  def create_subkeys(gpg_key)
-    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(gpg_key.key)
-
-    gpg_subkeys[gpg_key.primary_keyid.upcase]&.each do |subkey_data|
-      gpg_key.subkeys.build(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
-    end
-
-    # Improve latency by doing all INSERTs in a single call
-    GpgKey.transaction do
-      gpg_key.save!
-    end
-  end
-
-  def update_signatures(gpg_key)
-    InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
-  end
-end
diff --git a/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
new file mode 100644
index 00000000000..c8bbfbccc08
--- /dev/null
+++ b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
@@ -0,0 +1,25 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class ScheduleCreateGpgKeySubkeysFromGpgKeys < ActiveRecord::Migration
+  disable_ddl_transaction!
+
+  DOWNTIME = false
+
+  class GpgKey < ActiveRecord::Base
+    self.table_name = 'gpg_keys'
+  end
+
+  def up
+    GpgKey.select(:id).in_batches do |relation|
+      jobs = relation.pluck(:id).map do |id|
+        ['CreateGpgKeySubkeysFromGpgKeys', [id]]
+      end
+
+      BackgroundMigrationWorker.perform_bulk(jobs)
+    end
+  end
+
+  def down
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 3bcfbcc3fd1..3a69e3d3056 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20171004121444) do
+ActiveRecord::Schema.define(version: 20171005130944) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
diff --git a/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb b/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb
new file mode 100644
index 00000000000..3a32134b991
--- /dev/null
+++ b/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb
@@ -0,0 +1,50 @@
+class Gitlab::BackgroundMigration::CreateGpgKeySubkeysFromGpgKeys
+  class GpgKey < ActiveRecord::Base
+    self.table_name = 'gpg_keys'
+
+    include EachBatch
+    include ShaAttribute
+
+    sha_attribute :primary_keyid
+    sha_attribute :fingerprint
+
+    has_many :subkeys, class_name: 'GpgKeySubkey'
+  end
+
+  class GpgKeySubkey < ActiveRecord::Base
+    self.table_name = 'gpg_key_subkeys'
+
+    include ShaAttribute
+
+    sha_attribute :keyid
+    sha_attribute :fingerprint
+  end
+
+  def perform(gpg_key_id)
+    gpg_key = GpgKey.find_by(id: gpg_key_id)
+
+    return if gpg_key.nil?
+    return if gpg_key.subkeys.any?
+
+    create_subkeys(gpg_key) && update_signatures(gpg_key)
+  end
+
+  private
+
+  def create_subkeys(gpg_key)
+    gpg_subkeys = Gitlab::Gpg.subkeys_from_key(gpg_key.key)
+
+    gpg_subkeys[gpg_key.primary_keyid.upcase]&.each do |subkey_data|
+      gpg_key.subkeys.build(keyid: subkey_data[:keyid], fingerprint: subkey_data[:fingerprint])
+    end
+
+    # Improve latency by doing all INSERTs in a single call
+    GpgKey.transaction do
+      gpg_key.save!
+    end
+  end
+
+  def update_signatures(gpg_key)
+    InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
+  end
+end
-- 
cgit v1.2.1


From bd8e3606a202273129b963742aa071a0d2c8812f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 5 Oct 2017 08:24:27 -0500
Subject: Don't call update signature worker when there aren't subkeys

---
 .../background_migration/create_gpg_key_subkeys_from_gpg_keys.rb     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb b/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb
index 3a32134b991..e94719db72e 100644
--- a/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb
+++ b/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys.rb
@@ -26,7 +26,8 @@ class Gitlab::BackgroundMigration::CreateGpgKeySubkeysFromGpgKeys
     return if gpg_key.nil?
     return if gpg_key.subkeys.any?
 
-    create_subkeys(gpg_key) && update_signatures(gpg_key)
+    create_subkeys(gpg_key)
+    update_signatures(gpg_key)
   end
 
   private
@@ -45,6 +46,8 @@ class Gitlab::BackgroundMigration::CreateGpgKeySubkeysFromGpgKeys
   end
 
   def update_signatures(gpg_key)
+    return unless gpg_key.subkeys.exists?
+
     InvalidGpgSignatureUpdateWorker.perform_async(gpg_key.id)
   end
 end
-- 
cgit v1.2.1


From 91f8e734fee1f9e7a16573f7185c48f442e3bb5e Mon Sep 17 00:00:00 2001
From: Alessio Caiazza <acaiazza@gitlab.com>
Date: Mon, 25 Sep 2017 18:54:08 +0200
Subject: Add CI build trace sections extractor

---
 app/models/ci/build.rb                             | 22 +++++
 app/models/ci/build_trace_section.rb               | 11 +++
 app/models/ci/build_trace_section_name.rb          | 11 +++
 app/models/project.rb                              |  1 +
 app/workers/build_finished_worker.rb               |  1 +
 app/workers/build_trace_sections_worker.rb         |  8 ++
 .../unreleased/37970-ci-sections-tracking.yml      |  5 ++
 ...0170926102201_create_ci_build_trace_sections.rb | 19 +++++
 ...build_foreign_key_to_ci_build_trace_sections.rb | 15 ++++
 ...29123651_create_ci_build_trace_section_names.rb | 19 +++++
 ..._name_foreign_key_to_ci_build_trace_sections.rb | 15 ++++
 db/schema.rb                                       | 24 ++++++
 lib/gitlab/ci/ansi2html.rb                         |  2 +-
 lib/gitlab/ci/trace.rb                             |  6 ++
 lib/gitlab/ci/trace/section_parser.rb              | 97 ++++++++++++++++++++++
 lib/gitlab/ci/trace/stream.rb                      | 17 ++++
 lib/gitlab/regex.rb                                |  4 +
 spec/factories/ci/build_trace_section_names.rb     |  6 ++
 spec/fixtures/trace/trace_with_sections            | 15 ++++
 spec/lib/gitlab/ci/trace/section_parser_spec.rb    | 87 +++++++++++++++++++
 spec/lib/gitlab/ci/trace_spec.rb                   | 87 +++++++++++++++++++
 spec/lib/gitlab/import_export/all_models.yml       |  1 +
 spec/models/ci/build_spec.rb                       | 23 +++++
 spec/models/ci/build_trace_section_name_spec.rb    | 12 +++
 spec/models/ci/build_trace_section_spec.rb         | 11 +++
 spec/models/project_spec.rb                        |  1 +
 spec/services/ci/retry_build_service_spec.rb       |  2 +-
 spec/workers/build_finished_worker_spec.rb         |  2 +
 spec/workers/build_trace_sections_worker_spec.rb   | 23 +++++
 29 files changed, 545 insertions(+), 2 deletions(-)
 create mode 100644 app/models/ci/build_trace_section.rb
 create mode 100644 app/models/ci/build_trace_section_name.rb
 create mode 100644 app/workers/build_trace_sections_worker.rb
 create mode 100644 changelogs/unreleased/37970-ci-sections-tracking.yml
 create mode 100644 db/migrate/20170926102201_create_ci_build_trace_sections.rb
 create mode 100644 db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
 create mode 100644 db/migrate/20170929123651_create_ci_build_trace_section_names.rb
 create mode 100644 db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
 create mode 100644 lib/gitlab/ci/trace/section_parser.rb
 create mode 100644 spec/factories/ci/build_trace_section_names.rb
 create mode 100644 spec/fixtures/trace/trace_with_sections
 create mode 100644 spec/lib/gitlab/ci/trace/section_parser_spec.rb
 create mode 100644 spec/models/ci/build_trace_section_name_spec.rb
 create mode 100644 spec/models/ci/build_trace_section_spec.rb
 create mode 100644 spec/workers/build_trace_sections_worker_spec.rb

diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index dd315866e60..72e646210a8 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -11,6 +11,7 @@ module Ci
 
     has_many :deployments, as: :deployable
     has_one :last_deployment, -> { order('deployments.id DESC') }, as: :deployable, class_name: 'Deployment'
+    has_many :trace_sections, class_name: 'Ci::BuildTraceSection'
 
     # The "environment" field for builds is a String, and is the unexpanded name
     def persisted_environment
@@ -265,6 +266,27 @@ module Ci
       update_attributes(coverage: coverage) if coverage.present?
     end
 
+    def parse_trace_sections!
+      return false unless trace_sections.empty?
+
+      sections = trace.extract_sections.map do |attr|
+        name = attr.delete(:name)
+        name_record = begin
+                        project.build_trace_section_names.find_or_create_by!(name: name)
+                      rescue ActiveRecord::RecordInvalid
+                        project.build_trace_section_names.find_by!(name: name)
+                      end
+
+        attr.merge(
+          build_id: self.id,
+          project_id: self.project_id,
+          section_name_id: name_record.id)
+      end
+
+      Gitlab::Database.bulk_insert(Ci::BuildTraceSection.table_name, sections)
+      true
+    end
+
     def trace
       Gitlab::Ci::Trace.new(self)
     end
diff --git a/app/models/ci/build_trace_section.rb b/app/models/ci/build_trace_section.rb
new file mode 100644
index 00000000000..ccdb95546c8
--- /dev/null
+++ b/app/models/ci/build_trace_section.rb
@@ -0,0 +1,11 @@
+module Ci
+  class BuildTraceSection < ActiveRecord::Base
+    extend Gitlab::Ci::Model
+
+    belongs_to :build, class_name: 'Ci::Build'
+    belongs_to :project
+    belongs_to :section_name, class_name: 'Ci::BuildTraceSectionName'
+
+    validates :section_name, :build, :project, presence: true, allow_blank: false
+  end
+end
diff --git a/app/models/ci/build_trace_section_name.rb b/app/models/ci/build_trace_section_name.rb
new file mode 100644
index 00000000000..0fdcb1ea329
--- /dev/null
+++ b/app/models/ci/build_trace_section_name.rb
@@ -0,0 +1,11 @@
+module Ci
+  class BuildTraceSectionName < ActiveRecord::Base
+    extend Gitlab::Ci::Model
+
+    belongs_to :project
+    has_many :trace_sections, class_name: 'Ci::BuildTraceSection', foreign_key: :section_name_id
+
+    validates :name, :project, presence: true, allow_blank: false
+    validates :name, uniqueness: { scope: :project_id }
+  end
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index 59b5a5b3cd7..4d4d028dd7e 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -179,6 +179,7 @@ class Project < ActiveRecord::Base
   # bulk that doesn't involve loading the rows into memory. As a result we're
   # still using `dependent: :destroy` here.
   has_many :builds, class_name: 'Ci::Build', dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
+  has_many :build_trace_section_names, class_name: 'Ci::BuildTraceSectionName'
   has_many :runner_projects, class_name: 'Ci::RunnerProject'
   has_many :runners, through: :runner_projects, source: :runner, class_name: 'Ci::Runner'
   has_many :variables, class_name: 'Ci::Variable'
diff --git a/app/workers/build_finished_worker.rb b/app/workers/build_finished_worker.rb
index e2a1b3dcc41..52e7d346e74 100644
--- a/app/workers/build_finished_worker.rb
+++ b/app/workers/build_finished_worker.rb
@@ -6,6 +6,7 @@ class BuildFinishedWorker
 
   def perform(build_id)
     Ci::Build.find_by(id: build_id).try do |build|
+      BuildTraceSectionsWorker.perform_async(build.id)
       BuildCoverageWorker.new.perform(build.id)
       BuildHooksWorker.new.perform(build.id)
     end
diff --git a/app/workers/build_trace_sections_worker.rb b/app/workers/build_trace_sections_worker.rb
new file mode 100644
index 00000000000..8c57e8f767b
--- /dev/null
+++ b/app/workers/build_trace_sections_worker.rb
@@ -0,0 +1,8 @@
+class BuildTraceSectionsWorker
+  include Sidekiq::Worker
+  include PipelineQueue
+
+  def perform(build_id)
+    Ci::Build.find_by(id: build_id)&.parse_trace_sections!
+  end
+end
diff --git a/changelogs/unreleased/37970-ci-sections-tracking.yml b/changelogs/unreleased/37970-ci-sections-tracking.yml
new file mode 100644
index 00000000000..a9011b22c6c
--- /dev/null
+++ b/changelogs/unreleased/37970-ci-sections-tracking.yml
@@ -0,0 +1,5 @@
+---
+title: Parse and store gitlab-runner timestamped section markers
+merge_request: 14551
+author:
+type: added
diff --git a/db/migrate/20170926102201_create_ci_build_trace_sections.rb b/db/migrate/20170926102201_create_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..ad11b31b75d
--- /dev/null
+++ b/db/migrate/20170926102201_create_ci_build_trace_sections.rb
@@ -0,0 +1,19 @@
+class CreateCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    create_table :ci_build_trace_sections do |t|
+      t.datetime_with_timezone :date_start, null: false
+      t.datetime_with_timezone :date_end, null: false
+      t.integer :byte_start, limit: 8, null: false
+      t.integer :byte_end, limit: 8, null: false
+      t.references :project, null: false, index: true, foreign_key: { on_delete: :cascade }
+      t.integer :build_id, null: false
+      t.integer :section_name_id, null: false
+    end
+
+    add_index :ci_build_trace_sections, [:build_id, :section_name_id], unique: true
+  end
+end
diff --git a/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..d279463eb4b
--- /dev/null
+++ b/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
@@ -0,0 +1,15 @@
+class AddBuildForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_builds, column: :build_id)
+  end
+
+  def down
+    remove_foreign_key(:ci_build_trace_sections, column: :build_id)
+  end
+end
diff --git a/db/migrate/20170929123651_create_ci_build_trace_section_names.rb b/db/migrate/20170929123651_create_ci_build_trace_section_names.rb
new file mode 100644
index 00000000000..88f3e60699a
--- /dev/null
+++ b/db/migrate/20170929123651_create_ci_build_trace_section_names.rb
@@ -0,0 +1,19 @@
+class CreateCiBuildTraceSectionNames < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def up
+    create_table :ci_build_trace_section_names do |t|
+      t.references :project, null: false, foreign_key: { on_delete: :cascade }
+      t.string :name, null: false
+    end
+
+    add_index :ci_build_trace_section_names, [:project_id, :name], unique: true
+  end
+
+  def down
+    remove_foreign_key :ci_build_trace_section_names, column: :project_id
+    drop_table :ci_build_trace_section_names
+  end
+end
diff --git a/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..08422885a98
--- /dev/null
+++ b/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
@@ -0,0 +1,15 @@
+class AddNameForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_build_trace_section_names, column: :section_name_id)
+  end
+
+  def down
+    remove_foreign_key(:ci_build_trace_sections, column: :section_name_id)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index fa1aad257db..4f2424ff2ab 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -207,6 +207,26 @@ ActiveRecord::Schema.define(version: 20171004121444) do
 
   add_index "chat_teams", ["namespace_id"], name: "index_chat_teams_on_namespace_id", unique: true, using: :btree
 
+  create_table "ci_build_trace_section_names", force: :cascade do |t|
+    t.integer "project_id", null: false
+    t.string "name", null: false
+  end
+
+  add_index "ci_build_trace_section_names", ["project_id", "name"], name: "index_ci_build_trace_section_names_on_project_id_and_name", unique: true, using: :btree
+
+  create_table "ci_build_trace_sections", force: :cascade do |t|
+    t.datetime_with_timezone "date_start", null: false
+    t.datetime_with_timezone "date_end", null: false
+    t.integer "byte_start", limit: 8, null: false
+    t.integer "byte_end", limit: 8, null: false
+    t.integer "project_id", null: false
+    t.integer "build_id", null: false
+    t.integer "section_name_id", null: false
+  end
+
+  add_index "ci_build_trace_sections", ["build_id", "section_name_id"], name: "index_ci_build_trace_sections_on_build_id_and_section_name_id", unique: true, using: :btree
+  add_index "ci_build_trace_sections", ["project_id"], name: "index_ci_build_trace_sections_on_project_id", using: :btree
+
   create_table "ci_builds", force: :cascade do |t|
     t.string "status"
     t.datetime "finished_at"
@@ -1697,6 +1717,10 @@ ActiveRecord::Schema.define(version: 20171004121444) do
 
   add_foreign_key "boards", "projects", name: "fk_f15266b5f9", on_delete: :cascade
   add_foreign_key "chat_teams", "namespaces", on_delete: :cascade
+  add_foreign_key "ci_build_trace_section_names", "projects", on_delete: :cascade
+  add_foreign_key "ci_build_trace_sections", "ci_build_trace_section_names", column: "section_name_id", name: "fk_264e112c66", on_delete: :cascade
+  add_foreign_key "ci_build_trace_sections", "ci_builds", column: "build_id", name: "fk_4ebe41f502", on_delete: :cascade
+  add_foreign_key "ci_build_trace_sections", "projects", on_delete: :cascade
   add_foreign_key "ci_builds", "ci_pipelines", column: "auto_canceled_by_id", name: "fk_a2141b1522", on_delete: :nullify
   add_foreign_key "ci_builds", "ci_stages", column: "stage_id", name: "fk_3a9eaa254d", on_delete: :cascade
   add_foreign_key "ci_builds", "projects", name: "fk_befce0568a", on_delete: :cascade
diff --git a/lib/gitlab/ci/ansi2html.rb b/lib/gitlab/ci/ansi2html.rb
index 088adbdd267..72b75791bbb 100644
--- a/lib/gitlab/ci/ansi2html.rb
+++ b/lib/gitlab/ci/ansi2html.rb
@@ -155,7 +155,7 @@ module Gitlab
           stream.each_line do |line|
             s = StringScanner.new(line)
             until s.eos?
-              if s.scan(/section_((?:start)|(?:end)):(\d+):([^\r]+)\r\033\[0K/)
+              if s.scan(Gitlab::Regex.build_trace_section_regex)
                 handle_section(s)
               elsif s.scan(/\e([@-_])(.*?)([@-~])/)
                 handle_sequence(s)
diff --git a/lib/gitlab/ci/trace.rb b/lib/gitlab/ci/trace.rb
index 5b835bb669a..baf55b1fa07 100644
--- a/lib/gitlab/ci/trace.rb
+++ b/lib/gitlab/ci/trace.rb
@@ -27,6 +27,12 @@ module Gitlab
         end
       end
 
+      def extract_sections
+        read do |stream|
+          stream.extract_sections
+        end
+      end
+
       def set(data)
         write do |stream|
           data = job.hide_secrets(data)
diff --git a/lib/gitlab/ci/trace/section_parser.rb b/lib/gitlab/ci/trace/section_parser.rb
new file mode 100644
index 00000000000..9bb0166c9e3
--- /dev/null
+++ b/lib/gitlab/ci/trace/section_parser.rb
@@ -0,0 +1,97 @@
+module Gitlab
+  module Ci
+    class Trace
+      class SectionParser
+        def initialize(lines)
+          @lines = lines
+        end
+
+        def parse!
+          @markers = {}
+
+          @lines.each do |line, pos|
+            parse_line(line, pos)
+          end
+        end
+
+        def sections
+          sanitize_markers.map do |name, markers|
+            start_, end_ = markers
+
+            {
+              name: name,
+              byte_start: start_[:marker],
+              byte_end: end_[:marker],
+              date_start: start_[:timestamp],
+              date_end: end_[:timestamp]
+            }
+          end
+        end
+
+        private
+
+        def parse_line(line, line_start_position)
+          s = StringScanner.new(line)
+          until s.eos?
+            find_next_marker(s) do |scanner|
+              marker_begins_at = line_start_position + scanner.pointer
+
+              if scanner.scan(Gitlab::Regex.build_trace_section_regex)
+                marker_ends_at = line_start_position + scanner.pointer
+                handle_line(scanner[1], scanner[2].to_i, scanner[3], marker_begins_at, marker_ends_at)
+                true
+              else
+                false
+              end
+            end
+          end
+        end
+
+        def sanitize_markers
+          @markers.select do |_, markers|
+            markers.size == 2 && markers[0][:action] == :start && markers[1][:action] == :end
+          end
+        end
+
+        def handle_line(action, time, name, marker_start, marker_end)
+          action = action.to_sym
+          timestamp = Time.at(time).utc
+          marker = if action == :start
+                     marker_end
+                   else
+                     marker_start
+                   end
+
+          @markers[name] ||= []
+          @markers[name] << {
+            name: name,
+            action: action,
+            timestamp: timestamp,
+            marker: marker
+          }
+        end
+
+        def beginning_of_section_regex
+          @beginning_of_section_regex ||= /section_/.freeze
+        end
+
+        def find_next_marker(s)
+          beginning_of_section_len = 8
+          maybe_marker = s.exist?(beginning_of_section_regex)
+
+          if maybe_marker.nil?
+            s.terminate
+          else
+            # repositioning at the beginning of the match
+            s.pos += maybe_marker - beginning_of_section_len
+            if block_given?
+              good_marker = yield(s)
+              # if not a good marker: Consuming the matched beginning_of_section_regex
+              s.pos += beginning_of_section_len unless good_marker
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/trace/stream.rb b/lib/gitlab/ci/trace/stream.rb
index ab3408f48d6..d52194f688b 100644
--- a/lib/gitlab/ci/trace/stream.rb
+++ b/lib/gitlab/ci/trace/stream.rb
@@ -90,8 +90,25 @@ module Gitlab
           # so we just silently ignore error for now
         end
 
+        def extract_sections
+          return [] unless valid?
+
+          lines = to_enum(:each_line_with_pos)
+          parser = SectionParser.new(lines)
+
+          parser.parse!
+          parser.sections
+        end
+
         private
 
+        def each_line_with_pos
+          stream.seek(0, IO::SEEK_SET)
+          stream.each_line do |line|
+            yield [line, stream.pos - line.bytesize]
+          end
+        end
+
         def read_last_lines(limit)
           to_enum(:reverse_line).first(limit).reverse.join
         end
diff --git a/lib/gitlab/regex.rb b/lib/gitlab/regex.rb
index 58f6245579a..bd677ec4bf3 100644
--- a/lib/gitlab/regex.rb
+++ b/lib/gitlab/regex.rb
@@ -65,5 +65,9 @@ module Gitlab
       "can contain only lowercase letters, digits, and '-'. " \
       "Must start with a letter, and cannot end with '-'"
     end
+
+    def build_trace_section_regex
+      @build_trace_section_regexp ||= /section_((?:start)|(?:end)):(\d+):([^\r]+)\r\033\[0K/.freeze
+    end
   end
 end
diff --git a/spec/factories/ci/build_trace_section_names.rb b/spec/factories/ci/build_trace_section_names.rb
new file mode 100644
index 00000000000..1c16225f0e5
--- /dev/null
+++ b/spec/factories/ci/build_trace_section_names.rb
@@ -0,0 +1,6 @@
+FactoryGirl.define do
+  factory :ci_build_trace_section_name, class: Ci::BuildTraceSectionName do
+    sequence(:name) { |n| "section_#{n}" }
+    project factory: :project
+  end
+end
diff --git a/spec/fixtures/trace/trace_with_sections b/spec/fixtures/trace/trace_with_sections
new file mode 100644
index 00000000000..21dff3928c3
--- /dev/null
+++ b/spec/fixtures/trace/trace_with_sections
@@ -0,0 +1,15 @@
+Running with gitlab-runner dev (HEAD)
+  on kitsune minikube (a21b584f)
+WARNING: Namespace is empty, therefore assuming 'default'.
+Using Kubernetes namespace: default
+Using Kubernetes executor with image alpine:3.4 ...
+section_start:1506004954:prepare_script
Waiting for pod default/runner-a21b584f-project-1208199-concurrent-0sg03f to be running, status is Pending
+Running on runner-a21b584f-project-1208199-concurrent-0sg03f via kitsune.local...
+section_end:1506004957:prepare_script
section_start:1506004957:get_sources
Cloning repository...
+Cloning into '/nolith/ci-tests'...
+Checking out dddd7a6e as master...
+Skipping Git submodules setup
+section_end:1506004958:get_sources
section_start:1506004958:restore_cache
section_end:1506004958:restore_cache
section_start:1506004958:download_artifacts
section_end:1506004958:download_artifacts
section_start:1506004958:build_script
$ whoami
+root
+section_end:1506004959:build_script
section_start:1506004959:after_script
section_end:1506004959:after_script
section_start:1506004959:archive_cache
section_end:1506004959:archive_cache
section_start:1506004959:upload_artifacts
section_end:1506004959:upload_artifacts
Job succeeded
+
diff --git a/spec/lib/gitlab/ci/trace/section_parser_spec.rb b/spec/lib/gitlab/ci/trace/section_parser_spec.rb
new file mode 100644
index 00000000000..ca53ff87c6f
--- /dev/null
+++ b/spec/lib/gitlab/ci/trace/section_parser_spec.rb
@@ -0,0 +1,87 @@
+require 'spec_helper'
+
+describe Gitlab::Ci::Trace::SectionParser do
+  def lines_with_pos(text)
+    pos = 0
+    StringIO.new(text).each_line do |line|
+      yield line, pos
+      pos += line.bytesize + 1 # newline
+    end
+  end
+
+  def build_lines(text)
+    to_enum(:lines_with_pos, text)
+  end
+
+  def section(name, start, duration, text)
+    end_ = start + duration
+    "section_start:#{start.to_i}:#{name}\r\033[0K#{text}section_end:#{end_.to_i}:#{name}\r\033[0K"
+  end
+
+  let(:lines) { build_lines('') }
+  subject { described_class.new(lines) }
+
+  describe '#sections' do
+    before do
+      subject.parse!
+    end
+
+    context 'empty trace' do
+      let(:lines) { build_lines('') }
+
+      it { expect(subject.sections).to be_empty }
+    end
+
+    context 'with a sectionless trace' do
+      let(:lines) { build_lines("line 1\nline 2\n") }
+
+      it { expect(subject.sections).to be_empty }
+    end
+
+    context 'with trace markers' do
+      let(:start_time) { Time.new(2017, 10, 5).utc }
+      let(:section_b_duration) { 1.second }
+      let(:section_a) { section('a', start_time, 0, 'a line') }
+      let(:section_b) { section('b', start_time, section_b_duration, "another line\n") }
+      let(:lines) { build_lines(section_a + section_b) }
+
+      it { expect(subject.sections.size).to eq(2) }
+      it { expect(subject.sections[1][:name]).to eq('b') }
+      it { expect(subject.sections[1][:date_start]).to eq(start_time) }
+      it { expect(subject.sections[1][:date_end]).to eq(start_time + section_b_duration) }
+    end
+  end
+
+  describe '#parse!' do
+    context 'multiple "section_" but no complete markers' do
+      let(:lines) { build_lines('section_section_section_') }
+
+      it 'must find 3 possible section start but no complete sections' do
+        expect(subject).to receive(:find_next_marker).exactly(3).times.and_call_original
+
+        subject.parse!
+
+        expect(subject.sections).to be_empty
+      end
+    end
+
+    context 'trace with UTF-8 chars' do
+      let(:line) { 'GitLab ❤️ 狸 (tanukis)\n' }
+      let(:trace) { section('test_section', Time.new(2017, 10, 5).utc, 3.seconds, line) }
+      let(:lines) { build_lines(trace) }
+
+      it 'must handle correctly byte positioning' do
+        expect(subject).to receive(:find_next_marker).exactly(2).times.and_call_original
+
+        subject.parse!
+
+        sections = subject.sections
+
+        expect(sections.size).to eq(1)
+        s = sections[0]
+        len = s[:byte_end] - s[:byte_start]
+        expect(trace.byteslice(s[:byte_start], len)).to eq(line)
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/trace_spec.rb b/spec/lib/gitlab/ci/trace_spec.rb
index 9cb0b62590a..3546532b9b4 100644
--- a/spec/lib/gitlab/ci/trace_spec.rb
+++ b/spec/lib/gitlab/ci/trace_spec.rb
@@ -61,6 +61,93 @@ describe Gitlab::Ci::Trace do
     end
   end
 
+  describe '#extract_sections' do
+    let(:log) { 'No sections' }
+    let(:sections) { trace.extract_sections }
+
+    before do
+      trace.set(log)
+    end
+
+    context 'no sections' do
+      it 'returs []' do
+        expect(trace.extract_sections).to eq([])
+      end
+    end
+
+    context 'multiple sections available' do
+      let(:log) { File.read(expand_fixture_path('trace/trace_with_sections')) }
+      let(:sections_data) do
+        [
+          { name: 'prepare_script', lines: 2, duration: 3.seconds },
+          { name: 'get_sources', lines: 4, duration: 1.second },
+          { name: 'restore_cache', lines: 0, duration: 0.seconds },
+          { name: 'download_artifacts', lines: 0, duration: 0.seconds },
+          { name: 'build_script', lines: 2, duration: 1.second },
+          { name: 'after_script', lines: 0, duration: 0.seconds },
+          { name: 'archive_cache', lines: 0, duration: 0.seconds },
+          { name: 'upload_artifacts', lines: 0, duration: 0.seconds }
+        ]
+      end
+
+      it "returns valid sections" do
+        expect(sections).not_to be_empty
+        expect(sections.size).to eq(sections_data.size),
+                                 "expected #{sections_data.size} sections, got #{sections.size}"
+
+        buff = StringIO.new(log)
+        sections.each_with_index do |s, i|
+          expected = sections_data[i]
+
+          expect(s[:name]).to eq(expected[:name])
+          expect(s[:date_end] - s[:date_start]).to eq(expected[:duration])
+
+          buff.seek(s[:byte_start], IO::SEEK_SET)
+          length = s[:byte_end] - s[:byte_start]
+          lines = buff.read(length).count("\n")
+          expect(lines).to eq(expected[:lines])
+        end
+      end
+    end
+
+    context 'logs contains "section_start"' do
+      let(:log) { "section_start:1506417476:a_section\r\033[0Klooks like a section_start:invalid\nsection_end:1506417477:a_section\r\033[0K"}
+
+      it "returns only one section" do
+        expect(sections).not_to be_empty
+        expect(sections.size).to eq(1)
+
+        section = sections[0]
+        expect(section[:name]).to eq('a_section')
+        expect(section[:byte_start]).not_to eq(section[:byte_end]), "got an empty section"
+      end
+    end
+
+    context 'missing section_end' do
+      let(:log) { "section_start:1506417476:a_section\r\033[0KSome logs\nNo section_end\n"}
+
+      it "returns no sections" do
+        expect(sections).to be_empty
+      end
+    end
+
+    context 'missing section_start' do
+      let(:log) { "Some logs\nNo section_start\nsection_end:1506417476:a_section\r\033[0K"}
+
+      it "returns no sections" do
+        expect(sections).to be_empty
+      end
+    end
+
+    context 'inverted section_start section_end' do
+      let(:log) { "section_end:1506417476:a_section\r\033[0Klooks like a section_start:invalid\nsection_start:1506417477:a_section\r\033[0K"}
+
+      it "returns no sections" do
+        expect(sections).to be_empty
+      end
+    end
+  end
+
   describe '#set' do
     before do
       trace.set("12")
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index 3fb8edeb701..195997e3501 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -266,6 +266,7 @@ project:
 - container_repositories
 - uploads
 - members_and_requesters
+- build_trace_section_names
 award_emoji:
 - awardable
 - user
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 451968c7342..7fe12f92a2a 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -18,6 +18,7 @@ describe Ci::Build do
   it { is_expected.to belong_to(:trigger_request) }
   it { is_expected.to belong_to(:erased_by) }
   it { is_expected.to have_many(:deployments) }
+  it { is_expected.to have_many(:trace_sections)}
   it { is_expected.to validate_presence_of(:ref) }
   it { is_expected.to respond_to(:has_trace?) }
   it { is_expected.to respond_to(:trace) }
@@ -320,6 +321,28 @@ describe Ci::Build do
     end
   end
 
+  describe '#parse_trace_sections!' do
+    context "when the build trace has sections markers," do
+      before do
+        build.trace.set(File.read(expand_fixture_path('trace/trace_with_sections')))
+      end
+
+      it "saves the correct extracted sections" do
+        expect(build.trace_sections).to be_empty
+        expect(build.parse_trace_sections!).to be(true)
+        expect(build.trace_sections).not_to be_empty
+      end
+
+      it "fails if trace_sections isn't empty" do
+        expect(build.parse_trace_sections!).to be(true)
+        expect(build.trace_sections).not_to be_empty
+
+        expect(build.parse_trace_sections!).to be(false)
+        expect(build.trace_sections).not_to be_empty
+      end
+    end
+  end
+
   describe '#trace' do
     subject { build.trace }
 
diff --git a/spec/models/ci/build_trace_section_name_spec.rb b/spec/models/ci/build_trace_section_name_spec.rb
new file mode 100644
index 00000000000..386ee6880cb
--- /dev/null
+++ b/spec/models/ci/build_trace_section_name_spec.rb
@@ -0,0 +1,12 @@
+require 'spec_helper'
+
+describe Ci::BuildTraceSectionName, model: true do
+  subject { build(:ci_build_trace_section_name) }
+
+  it { is_expected.to belong_to(:project) }
+  it { is_expected.to have_many(:trace_sections)}
+
+  it { is_expected.to validate_presence_of(:project) }
+  it { is_expected.to validate_presence_of(:name) }
+  it { is_expected.to validate_uniqueness_of(:name).scoped_to(:project_id) }
+end
diff --git a/spec/models/ci/build_trace_section_spec.rb b/spec/models/ci/build_trace_section_spec.rb
new file mode 100644
index 00000000000..541a9a36fb8
--- /dev/null
+++ b/spec/models/ci/build_trace_section_spec.rb
@@ -0,0 +1,11 @@
+require 'spec_helper'
+
+describe Ci::BuildTraceSection, model: true do
+  it { is_expected.to belong_to(:build)}
+  it { is_expected.to belong_to(:project)}
+  it { is_expected.to belong_to(:section_name)}
+
+  it { is_expected.to validate_presence_of(:section_name) }
+  it { is_expected.to validate_presence_of(:build) }
+  it { is_expected.to validate_presence_of(:project) }
+end
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 176bb568cbe..1c04cb8cb5f 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -57,6 +57,7 @@ describe Project do
     it { is_expected.to have_many(:commit_statuses) }
     it { is_expected.to have_many(:pipelines) }
     it { is_expected.to have_many(:builds) }
+    it { is_expected.to have_many(:build_trace_section_names)}
     it { is_expected.to have_many(:runner_projects) }
     it { is_expected.to have_many(:runners) }
     it { is_expected.to have_many(:active_runners) }
diff --git a/spec/services/ci/retry_build_service_spec.rb b/spec/services/ci/retry_build_service_spec.rb
index fbb3213f42b..9db3568abee 100644
--- a/spec/services/ci/retry_build_service_spec.rb
+++ b/spec/services/ci/retry_build_service_spec.rb
@@ -20,7 +20,7 @@ describe Ci::RetryBuildService do
        erased_at auto_canceled_by].freeze
 
   IGNORE_ACCESSORS =
-    %i[type lock_version target_url base_tags
+    %i[type lock_version target_url base_tags trace_sections
        commit_id deployments erased_by_id last_deployment project_id
        runner_id tag_taggings taggings tags trigger_request_id
        user_id auto_canceled_by_id retried failure_reason].freeze
diff --git a/spec/workers/build_finished_worker_spec.rb b/spec/workers/build_finished_worker_spec.rb
index 8cc3f37ebe8..1a7ffd5cdbf 100644
--- a/spec/workers/build_finished_worker_spec.rb
+++ b/spec/workers/build_finished_worker_spec.rb
@@ -11,6 +11,8 @@ describe BuildFinishedWorker do
         expect(BuildHooksWorker)
           .to receive(:new).ordered.and_call_original
 
+        expect(BuildTraceSectionsWorker)
+          .to receive(:perform_async)
         expect_any_instance_of(BuildCoverageWorker)
           .to receive(:perform)
         expect_any_instance_of(BuildHooksWorker)
diff --git a/spec/workers/build_trace_sections_worker_spec.rb b/spec/workers/build_trace_sections_worker_spec.rb
new file mode 100644
index 00000000000..45243f45547
--- /dev/null
+++ b/spec/workers/build_trace_sections_worker_spec.rb
@@ -0,0 +1,23 @@
+require 'spec_helper'
+
+describe BuildTraceSectionsWorker do
+  describe '#perform' do
+    context 'when build exists' do
+      let!(:build) { create(:ci_build) }
+
+      it 'updates trace sections' do
+        expect_any_instance_of(Ci::Build)
+          .to receive(:parse_trace_sections!)
+
+        described_class.new.perform(build.id)
+      end
+    end
+
+    context 'when build does not exist' do
+      it 'does not raise exception' do
+        expect { described_class.new.perform(123) }
+          .not_to raise_error
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 0a7f27e1ad2aa4edaeaedce54a1fc5dd25b145ef Mon Sep 17 00:00:00 2001
From: James Ramsay <jramsay@gitlab.com>
Date: Tue, 26 Sep 2017 17:15:19 -0400
Subject: Docs: add translation and proof reading guidelines

---
 doc/development/README.md                   |   4 +-
 doc/development/i18n/externalization.md     | 297 ++++++++++++++++++++++++++++
 doc/development/i18n/img/crowdin-editor.png | Bin 0 -> 88701 bytes
 doc/development/i18n/introduction.md        |  74 +++++++
 doc/development/i18n/translation.md         |  61 ++++++
 doc/development/i18n_guide.md               | 297 ----------------------------
 6 files changed, 435 insertions(+), 298 deletions(-)
 create mode 100644 doc/development/i18n/externalization.md
 create mode 100644 doc/development/i18n/img/crowdin-editor.png
 create mode 100644 doc/development/i18n/introduction.md
 create mode 100644 doc/development/i18n/translation.md
 delete mode 100644 doc/development/i18n_guide.md

diff --git a/doc/development/README.md b/doc/development/README.md
index 3096d9f25f0..fbe3b172826 100644
--- a/doc/development/README.md
+++ b/doc/development/README.md
@@ -65,7 +65,9 @@
 
 ## i18n
 
-- [Internationalization for GitLab](i18n_guide.md)
+- [Introduction](i18n/introduction.md)
+- [Externalization](i18n/externalization.md)
+- [Translation](i18n/translation.md)
 
 ## Compliance
 
diff --git a/doc/development/i18n/externalization.md b/doc/development/i18n/externalization.md
new file mode 100644
index 00000000000..bd0ef39ca62
--- /dev/null
+++ b/doc/development/i18n/externalization.md
@@ -0,0 +1,297 @@
+# Internationalization for GitLab
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10669) in GitLab 9.2.
+
+For working with internationalization (i18n) we use
+[GNU gettext](https://www.gnu.org/software/gettext/) given it's the most used
+tool for this task and we have a lot of applications that will help us to work
+with it.
+
+## Setting up GitLab Development Kit (GDK)
+
+In order to be able to work on the [GitLab Community Edition](https://gitlab.com/gitlab-org/gitlab-ce) project we must download and
+configure it through [GDK](https://gitlab.com/gitlab-org/gitlab-development-kit), we can do it by following this [guide](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/set-up-gdk.md).
+
+Once we have the GitLab project ready we can start working on the
+translation of the project.
+
+## Tools
+
+We use a couple of gems:
+
+1. [`gettext_i18n_rails`](https://github.com/grosser/gettext_i18n_rails): this
+   gem allow us to translate content from models, views and controllers. Also
+   it gives us access to the following raketasks:
+    - `rake gettext:find`: Parses almost all the files from the
+      Rails application looking for content that has been marked for
+      translation. Finally, it updates the PO files with the new content that
+      it has found.
+    - `rake gettext:pack`: Processes the PO files and generates the
+      MO files that are binary and are finally used by the application.
+
+1. [`gettext_i18n_rails_js`](https://github.com/webhippie/gettext_i18n_rails_js):
+   this gem is useful to make the translations available in JavaScript. It
+   provides the following raketask:
+    - `rake gettext:po_to_json`: Reads the contents from the PO files and
+      generates JSON files containing all the available translations.
+
+1. PO editor: there are multiple applications that can help us to work with PO
+   files, a good option is [Poedit](https://poedit.net/download) which is
+   available for macOS, GNU/Linux and Windows.
+
+## Preparing a page for translation
+
+We basically have 4 types of files:
+
+1. Ruby files: basically Models and Controllers.
+1. HAML files: these are the view files.
+1. ERB files: used for email templates.
+1. JavaScript files: we mostly need to work with VUE JS templates.
+
+### Ruby files
+
+If there is a method or variable that works with a raw string, for instance:
+
+```ruby
+def hello
+  "Hello world!"
+end
+```
+
+Or:
+
+```ruby
+hello = "Hello world!"
+```
+
+You can easily mark that content for translation with:
+
+```ruby
+def hello
+  _("Hello world!")
+end
+```
+
+Or:
+
+```ruby
+hello = _("Hello world!")
+```
+
+### HAML files
+
+Given the following content in HAML:
+
+```haml
+%h1 Hello world!
+```
+
+You can mark that content for translation with:
+
+```haml
+%h1= _("Hello world!")
+```
+
+### ERB files
+
+Given the following content in ERB:
+
+```erb
+<h1>Hello world!</h1>
+```
+
+You can mark that content for translation with:
+
+```erb
+<h1><%= _("Hello world!") %></h1>
+```
+
+### JavaScript files
+
+In JavaScript we added the `__()` (double underscore parenthesis) function
+for translations.
+
+### Updating the PO files with the new content
+
+Now that the new content is marked for translation, we need to update the PO
+files with the following command:
+
+```sh
+bundle exec rake gettext:find
+```
+
+This command will update the `locale/**/gitlab.edit.po` file with the
+new content that the parser has found.
+
+New translations will be added with their default content and will be marked
+fuzzy. To use the translation, look for the `#, fuzzy` mention in `gitlab.edit.po`
+and remove it.
+
+We need to make sure we remove the `fuzzy` translations before generating the
+`locale/**/gitlab.po` file. When they aren't removed, the resulting `.po` will
+be treated as a binary file which could overwrite translations that were merged
+before the new translations.
+
+When we are just preparing a page to be translated, but not actually adding any
+translations. There's no need to generate `.po` files.
+
+Translations that aren't used in the source code anymore will be marked with
+`~#`; these can be removed to keep our translation files clutter-free.
+
+### Validating PO files
+
+To make sure we keep our translation files up to date, there's a linter that is
+running on CI as part of the `static-analysis` job.
+
+To lint the adjustments in PO files locally you can run `rake gettext:lint`.
+
+The linter will take the following into account:
+
+- Valid PO-file syntax
+- Variable usage
+  - Only one unnamed (`%d`) variable, since the order of variables might change
+    in different languages
+  - All variables used in the message-id are used in the translation
+  - There should be no variables used in a translation that aren't in the
+    message-id
+- Errors during translation.
+
+The errors are grouped per file, and per message ID:
+
+```
+Errors in `locale/zh_HK/gitlab.po`:
+  PO-syntax errors
+    SimplePoParser::ParserErrorSyntax error in lines
+    Syntax error in msgctxt
+    Syntax error in msgid
+    Syntax error in msgstr
+    Syntax error in message_line
+    There should be only whitespace until the end of line after the double quote character of a message text.
+    Parseing result before error: '{:msgid=>["", "You are going to remove %{project_name_with_namespace}.\\n", "Removed project CANNOT be restored!\\n", "Are you ABSOLUTELY sure?"]}'
+    SimplePoParser filtered backtrace: SimplePoParser::ParserError
+Errors in `locale/zh_TW/gitlab.po`:
+  1 pipeline
+    <%d 條流水線> is using unknown variables: [%d]
+    Failure translating to zh_TW with []: too few arguments
+```
+
+In this output the `locale/zh_HK/gitlab.po` has syntax errors.
+The `locale/zh_TW/gitlab.po` has variables that are used in the translation that
+aren't in the message with id `1 pipeline`.
+
+## Working with special content
+
+### Interpolation
+
+- In Ruby/HAML:
+
+    ```ruby
+    _("Hello %{name}") % { name: 'Joe' }
+    ```
+
+- In JavaScript: Not supported at this moment.
+
+### Plurals
+
+- In Ruby/HAML:
+
+    ```ruby
+    n_('Apple', 'Apples', 3) => 'Apples'
+    ```
+
+    Using interpolation:
+    ```ruby
+    n_("There is a mouse.", "There are %d mice.", size) % size
+    ```
+
+- In JavaScript:
+
+    ```js
+    n__('Apple', 'Apples', 3) => 'Apples'
+    ```
+
+    Using interpolation:
+
+    ```js
+    n__('Last day', 'Last %d days', 30) => 'Last 30 days'
+    ```
+
+### Namespaces
+
+Sometimes you need to add some context to the text that you want to translate
+(if the word occurs in a sentence and/or the word is ambiguous).
+
+- In Ruby/HAML:
+
+    ```ruby
+    s_('OpenedNDaysAgo|Opened')
+    ```
+
+    In case the translation is not found it will return `Opened`.
+
+- In JavaScript:
+
+    ```js
+    s__('OpenedNDaysAgo|Opened')
+    ```
+
+### Just marking content for parsing
+
+Sometimes there are some dynamic translations that can't be found by the
+parser when running `bundle exec rake gettext:find`. For these scenarios you can
+use the [`_N` method](https://github.com/grosser/gettext_i18n_rails/blob/c09e38d481e0899ca7d3fc01786834fa8e7aab97/Readme.md#unfound-translations-with-rake-gettextfind).
+
+There is also and alternative method to [translate messages from validation errors](https://github.com/grosser/gettext_i18n_rails/blob/c09e38d481e0899ca7d3fc01786834fa8e7aab97/Readme.md#option-a).
+
+## Adding a new language
+
+Let's suppose you want to add translations for a new language, let's say French.
+
+1. The first step is to register the new language in `lib/gitlab/i18n.rb`:
+
+    ```ruby
+    ...
+    AVAILABLE_LANGUAGES = {
+      ...,
+      'fr' => 'Français'
+    }.freeze
+    ...
+    ```
+
+1. Next, you need to add the language:
+
+    ```sh
+    bundle exec rake gettext:add_language[fr]
+    ```
+
+    If you want to add a new language for a specific region, the command is similar,
+    you just need to separate the region with an underscore (`_`). For example:
+
+    ```sh
+    bundle exec rake gettext:add_language[en_GB]
+    ```
+
+    Please note that you need to specify the region part in capitals.
+
+1. Now that the language is added, a new directory has been created under the
+   path: `locale/fr/`. You can now start using your PO editor to edit the PO file
+   located in: `locale/fr/gitlab.edit.po`.
+
+1. After you're done updating the translations, you need to process the PO files
+   in order to generate the binary MO files and finally update the JSON files
+   containing the translations:
+
+    ```sh
+    bundle exec rake gettext:compile
+    ```
+
+1. In order to see the translated content we need to change our preferred language
+   which can be found under the user's **Settings** (`/profile`).
+
+1. After checking that the changes are ok, you can proceed to commit the new files.
+   For example:
+
+    ```sh
+    git add locale/fr/ app/assets/javascripts/locale/fr/
+    git commit -m "Add French translations for Cycle Analytics page"
+    ```
diff --git a/doc/development/i18n/img/crowdin-editor.png b/doc/development/i18n/img/crowdin-editor.png
new file mode 100644
index 00000000000..5c31d8f0cec
Binary files /dev/null and b/doc/development/i18n/img/crowdin-editor.png differ
diff --git a/doc/development/i18n/introduction.md b/doc/development/i18n/introduction.md
new file mode 100644
index 00000000000..a54b09359ce
--- /dev/null
+++ b/doc/development/i18n/introduction.md
@@ -0,0 +1,74 @@
+# Translate GitLab to your language
+
+The text in GitLab's user interface is in English by default.
+Each string can be translated to other languages.
+As each string is translated, it is added to the languages translation file,
+and will be available in future releases of GitLab.
+
+Contributions to translations are always needed.
+Many strings are not yet available for translation because they have not been externalized.
+Helping externalize strings benefits all languages.
+Some translations are incomplete or inconsistent.
+Translating strings will help complete and improve each language.
+
+## How to contribute
+
+### Externalize strings
+
+Before a string can be translated, it must be externalized.
+This is the process where English strings in the GitLab source code are wrapped in a function that
+retrieves the translated string for the users language.
+
+As new features are added and existing features are updated the surrounding strings are being
+externalized, however, there are many parts of GitLab that still need more work to externalize all
+strings.
+
+See [Externalization for GitLab](externalization.md).
+
+### Translate strings
+
+The translation process is managed at [translate.gitlab.com](https://translate.gitlab.com)
+using [Crowdin](https://crowdin.com/).
+You will need to create an account before you can submit translations.
+Once you are signed in, select the language you wish to contribute translations to.
+
+Voting for translations is also valuable, helping to confirm good and flag inaccurate translations.
+
+See [Translation guidelines](translation.md).
+
+### Proof reading
+
+Proof reading helps ensure the accuracy and consistency of translations.
+All translations are proof read before being accepted.
+If a translations requires changes, you will be notified with a comment explaining why.
+
+Community assistance proof reading translations is encouraged and appreciated.
+Requests to become a proof reader will be considered on the merits of previous translations.
+
+- Bulgarian
+- Chinese Simplified
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Chinese Traditional
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Chinese Traditional, Hong Kong
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Dutch
+- Esperanto
+- French
+- German
+- Italian
+- Japanese
+- Korean
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Portuguese, Brazilian
+- Russian
+  - [Alexy Lustin](https://crowdin.com/profile/lustin)
+  - [Nikita Grylov](https://crowdin.com/profile/nixel2007)
+- Spanish
+- Ukrainian
+
+If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues) and add the `internationalization` label.
+
+### Release
+
+Translations are typically included in the next major or minor release.
diff --git a/doc/development/i18n/translation.md b/doc/development/i18n/translation.md
new file mode 100644
index 00000000000..cc61eef2e87
--- /dev/null
+++ b/doc/development/i18n/translation.md
@@ -0,0 +1,61 @@
+# Translating GitLab
+
+For managing the translation process we use [Crowdin](https://crowdin.com).
+
+## Using Crowdin
+
+### Sign In
+
+To contribute translations at [translate.gitlab.com](https://translate.gitlab.com)
+you must create a Crowdin account.
+You may create a new account or use any of their supported sign in services.
+
+### Language Selections
+
+GitLab is being translated into many languages.
+
+1. Select the language you would like to contribute translations to by clicking the flag
+1. You will see a list of files and folders.
+  Click `gitlab.pot` top open the translation editor.
+
+### Translation Editor
+
+The online translation editor is the easiest way to contribute translations.
+
+![Crowdin Editor](img/crowdin-editor.png)
+
+1. Strings for translation are listed in the left panel
+1. Translations are entered into the central panel.
+  Multiple translations will be required for strings that contains plurals.
+  The string to be translated is shown above with glossary terms highlighted.
+  If the string to be translated is not clear, you can 'Request Context'
+
+A glossary of common terms is available in the right panel by clicking Terms.
+Comments can be added to discuss a translation with the community
+
+Remember to **Save** each translation.
+
+## Translation Guidelines
+
+### Technical terms
+
+Technical terms should be treated like proper nouns and not be translated.
+This helps maintain a logical connection and consistency between tools (e.g. `git` client) and
+GitLab.
+
+Technical terms that should always be in English are noted in the glossary when using
+[translate.gitlab.com](https://translate.gitlab.com).
+
+### Formality
+
+The level of formality used in software varies by language.
+For example, in French we translate `you` as the informal `tu`.
+
+You can refer to other translated strings and notes in the glossary to assist determining a
+suitable level of formality.
+
+### Updating the glossary
+
+To propose additions to the glossary please
+[open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
+
diff --git a/doc/development/i18n_guide.md b/doc/development/i18n_guide.md
deleted file mode 100644
index bd0ef39ca62..00000000000
--- a/doc/development/i18n_guide.md
+++ /dev/null
@@ -1,297 +0,0 @@
-# Internationalization for GitLab
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10669) in GitLab 9.2.
-
-For working with internationalization (i18n) we use
-[GNU gettext](https://www.gnu.org/software/gettext/) given it's the most used
-tool for this task and we have a lot of applications that will help us to work
-with it.
-
-## Setting up GitLab Development Kit (GDK)
-
-In order to be able to work on the [GitLab Community Edition](https://gitlab.com/gitlab-org/gitlab-ce) project we must download and
-configure it through [GDK](https://gitlab.com/gitlab-org/gitlab-development-kit), we can do it by following this [guide](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/set-up-gdk.md).
-
-Once we have the GitLab project ready we can start working on the
-translation of the project.
-
-## Tools
-
-We use a couple of gems:
-
-1. [`gettext_i18n_rails`](https://github.com/grosser/gettext_i18n_rails): this
-   gem allow us to translate content from models, views and controllers. Also
-   it gives us access to the following raketasks:
-    - `rake gettext:find`: Parses almost all the files from the
-      Rails application looking for content that has been marked for
-      translation. Finally, it updates the PO files with the new content that
-      it has found.
-    - `rake gettext:pack`: Processes the PO files and generates the
-      MO files that are binary and are finally used by the application.
-
-1. [`gettext_i18n_rails_js`](https://github.com/webhippie/gettext_i18n_rails_js):
-   this gem is useful to make the translations available in JavaScript. It
-   provides the following raketask:
-    - `rake gettext:po_to_json`: Reads the contents from the PO files and
-      generates JSON files containing all the available translations.
-
-1. PO editor: there are multiple applications that can help us to work with PO
-   files, a good option is [Poedit](https://poedit.net/download) which is
-   available for macOS, GNU/Linux and Windows.
-
-## Preparing a page for translation
-
-We basically have 4 types of files:
-
-1. Ruby files: basically Models and Controllers.
-1. HAML files: these are the view files.
-1. ERB files: used for email templates.
-1. JavaScript files: we mostly need to work with VUE JS templates.
-
-### Ruby files
-
-If there is a method or variable that works with a raw string, for instance:
-
-```ruby
-def hello
-  "Hello world!"
-end
-```
-
-Or:
-
-```ruby
-hello = "Hello world!"
-```
-
-You can easily mark that content for translation with:
-
-```ruby
-def hello
-  _("Hello world!")
-end
-```
-
-Or:
-
-```ruby
-hello = _("Hello world!")
-```
-
-### HAML files
-
-Given the following content in HAML:
-
-```haml
-%h1 Hello world!
-```
-
-You can mark that content for translation with:
-
-```haml
-%h1= _("Hello world!")
-```
-
-### ERB files
-
-Given the following content in ERB:
-
-```erb
-<h1>Hello world!</h1>
-```
-
-You can mark that content for translation with:
-
-```erb
-<h1><%= _("Hello world!") %></h1>
-```
-
-### JavaScript files
-
-In JavaScript we added the `__()` (double underscore parenthesis) function
-for translations.
-
-### Updating the PO files with the new content
-
-Now that the new content is marked for translation, we need to update the PO
-files with the following command:
-
-```sh
-bundle exec rake gettext:find
-```
-
-This command will update the `locale/**/gitlab.edit.po` file with the
-new content that the parser has found.
-
-New translations will be added with their default content and will be marked
-fuzzy. To use the translation, look for the `#, fuzzy` mention in `gitlab.edit.po`
-and remove it.
-
-We need to make sure we remove the `fuzzy` translations before generating the
-`locale/**/gitlab.po` file. When they aren't removed, the resulting `.po` will
-be treated as a binary file which could overwrite translations that were merged
-before the new translations.
-
-When we are just preparing a page to be translated, but not actually adding any
-translations. There's no need to generate `.po` files.
-
-Translations that aren't used in the source code anymore will be marked with
-`~#`; these can be removed to keep our translation files clutter-free.
-
-### Validating PO files
-
-To make sure we keep our translation files up to date, there's a linter that is
-running on CI as part of the `static-analysis` job.
-
-To lint the adjustments in PO files locally you can run `rake gettext:lint`.
-
-The linter will take the following into account:
-
-- Valid PO-file syntax
-- Variable usage
-  - Only one unnamed (`%d`) variable, since the order of variables might change
-    in different languages
-  - All variables used in the message-id are used in the translation
-  - There should be no variables used in a translation that aren't in the
-    message-id
-- Errors during translation.
-
-The errors are grouped per file, and per message ID:
-
-```
-Errors in `locale/zh_HK/gitlab.po`:
-  PO-syntax errors
-    SimplePoParser::ParserErrorSyntax error in lines
-    Syntax error in msgctxt
-    Syntax error in msgid
-    Syntax error in msgstr
-    Syntax error in message_line
-    There should be only whitespace until the end of line after the double quote character of a message text.
-    Parseing result before error: '{:msgid=>["", "You are going to remove %{project_name_with_namespace}.\\n", "Removed project CANNOT be restored!\\n", "Are you ABSOLUTELY sure?"]}'
-    SimplePoParser filtered backtrace: SimplePoParser::ParserError
-Errors in `locale/zh_TW/gitlab.po`:
-  1 pipeline
-    <%d 條流水線> is using unknown variables: [%d]
-    Failure translating to zh_TW with []: too few arguments
-```
-
-In this output the `locale/zh_HK/gitlab.po` has syntax errors.
-The `locale/zh_TW/gitlab.po` has variables that are used in the translation that
-aren't in the message with id `1 pipeline`.
-
-## Working with special content
-
-### Interpolation
-
-- In Ruby/HAML:
-
-    ```ruby
-    _("Hello %{name}") % { name: 'Joe' }
-    ```
-
-- In JavaScript: Not supported at this moment.
-
-### Plurals
-
-- In Ruby/HAML:
-
-    ```ruby
-    n_('Apple', 'Apples', 3) => 'Apples'
-    ```
-
-    Using interpolation:
-    ```ruby
-    n_("There is a mouse.", "There are %d mice.", size) % size
-    ```
-
-- In JavaScript:
-
-    ```js
-    n__('Apple', 'Apples', 3) => 'Apples'
-    ```
-
-    Using interpolation:
-
-    ```js
-    n__('Last day', 'Last %d days', 30) => 'Last 30 days'
-    ```
-
-### Namespaces
-
-Sometimes you need to add some context to the text that you want to translate
-(if the word occurs in a sentence and/or the word is ambiguous).
-
-- In Ruby/HAML:
-
-    ```ruby
-    s_('OpenedNDaysAgo|Opened')
-    ```
-
-    In case the translation is not found it will return `Opened`.
-
-- In JavaScript:
-
-    ```js
-    s__('OpenedNDaysAgo|Opened')
-    ```
-
-### Just marking content for parsing
-
-Sometimes there are some dynamic translations that can't be found by the
-parser when running `bundle exec rake gettext:find`. For these scenarios you can
-use the [`_N` method](https://github.com/grosser/gettext_i18n_rails/blob/c09e38d481e0899ca7d3fc01786834fa8e7aab97/Readme.md#unfound-translations-with-rake-gettextfind).
-
-There is also and alternative method to [translate messages from validation errors](https://github.com/grosser/gettext_i18n_rails/blob/c09e38d481e0899ca7d3fc01786834fa8e7aab97/Readme.md#option-a).
-
-## Adding a new language
-
-Let's suppose you want to add translations for a new language, let's say French.
-
-1. The first step is to register the new language in `lib/gitlab/i18n.rb`:
-
-    ```ruby
-    ...
-    AVAILABLE_LANGUAGES = {
-      ...,
-      'fr' => 'Français'
-    }.freeze
-    ...
-    ```
-
-1. Next, you need to add the language:
-
-    ```sh
-    bundle exec rake gettext:add_language[fr]
-    ```
-
-    If you want to add a new language for a specific region, the command is similar,
-    you just need to separate the region with an underscore (`_`). For example:
-
-    ```sh
-    bundle exec rake gettext:add_language[en_GB]
-    ```
-
-    Please note that you need to specify the region part in capitals.
-
-1. Now that the language is added, a new directory has been created under the
-   path: `locale/fr/`. You can now start using your PO editor to edit the PO file
-   located in: `locale/fr/gitlab.edit.po`.
-
-1. After you're done updating the translations, you need to process the PO files
-   in order to generate the binary MO files and finally update the JSON files
-   containing the translations:
-
-    ```sh
-    bundle exec rake gettext:compile
-    ```
-
-1. In order to see the translated content we need to change our preferred language
-   which can be found under the user's **Settings** (`/profile`).
-
-1. After checking that the changes are ok, you can proceed to commit the new files.
-   For example:
-
-    ```sh
-    git add locale/fr/ app/assets/javascripts/locale/fr/
-    git commit -m "Add French translations for Cycle Analytics page"
-    ```
-- 
cgit v1.2.1


From 44baf2b0f4fdfe7402014484ad71a7d497d28088 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Thu, 5 Oct 2017 23:58:05 +0900
Subject: spec/features/projects/clusters_spec. Fix static analysys

---
 app/views/projects/clusters/login.html.haml        |   2 +-
 app/views/projects/clusters/show.html.haml         |   2 +-
 .../google_api/authorizations_controller_spec.rb   |   2 +-
 spec/features/projects/clusters_spec.rb            | 111 +++++++++++++++++++++
 4 files changed, 114 insertions(+), 3 deletions(-)
 create mode 100644 spec/features/projects/clusters_spec.rb

diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
index 1492f6163e1..5023abc5aa0 100644
--- a/app/views/projects/clusters/login.html.haml
+++ b/app/views/projects/clusters/login.html.haml
@@ -4,7 +4,7 @@
   .col-sm-8
     = render 'header'
 .row
-  .col-sm-8.col-sm-offset-4
+  .col-sm-8.col-sm-offset-4.signin-with-google
     - if @authorize_url
       = link_to @authorize_url do
         = image_tag('auth_buttons/signin_with_google.png')
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index f3124acfa1c..48d9835d588 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -54,7 +54,7 @@
       %label{ for: 'cluter_name' }
         = s_('ClusterIntegration|Cluster name')
       .input-group
-        %input.form-control{ value: @cluster.gcp_cluster_name, disabled: true}
+        %input.form-control.cluster-name{ value: @cluster.gcp_cluster_name, disabled: true}
         %span.input-group-addon.clipboard-addon
           = clipboard_button(text: @cluster.gcp_cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
 
diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
index 53d584d167c..64c16af582f 100644
--- a/spec/controllers/google_api/authorizations_controller_spec.rb
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -4,7 +4,7 @@ describe GoogleApi::AuthorizationsController do
   describe 'GET|POST #callback' do
     let(:user) { create(:user) }
     let(:project) { create(:project) }
-    let(:state) { namespace_project_clusters_url(project.namespace, project).to_s }
+    let(:state) { project_clusters_url(project).to_s }
     let(:token) { 'token' }
     let(:expires_at) { 1.hour.since.strftime('%s') }
 
diff --git a/spec/features/projects/clusters_spec.rb b/spec/features/projects/clusters_spec.rb
new file mode 100644
index 00000000000..b836427513d
--- /dev/null
+++ b/spec/features/projects/clusters_spec.rb
@@ -0,0 +1,111 @@
+require 'spec_helper'
+
+feature 'Clusters', :js do
+  let!(:project) { create(:project, :repository) }
+  let!(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+    gitlab_sign_in(user)
+  end
+
+  context 'when user has signed in Google' do
+    before do
+      allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+        .to receive(:validate_token).and_return(true)
+    end
+
+    context 'when user does not have a cluster and visits cluster index page' do
+      before do
+        visit project_clusters_path(project)
+      end
+
+      it 'user sees a new page' do
+        expect(page).to have_button('Create cluster')
+      end
+
+      context 'when user filled form with valid parameters' do
+        before do
+          double.tap do |dbl|
+            allow(dbl).to receive(:status).and_return('RUNNING')
+            allow(dbl).to receive(:self_link)
+              .and_return('projects/gcp-project-12345/zones/us-central1-a/operations/ope-123')
+            allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+              .to receive(:projects_zones_clusters_create).and_return(dbl)
+          end
+
+          allow(WaitForClusterCreationWorker).to receive(:perform_in).and_return(nil)
+
+          fill_in 'cluster_gcp_project_id', with: 'gcp-project-123'
+          fill_in 'cluster_gcp_cluster_name', with: 'dev-cluster'
+          click_button 'Create cluster'
+        end
+
+        it 'user sees a cluster details page and creation status' do
+          expect(page).to have_content('Cluster is being created on Google Container Engine...')
+
+          Gcp::Cluster.last.make_created!
+
+          expect(page).to have_content('Cluster was successfully created on Google Container Engine.')
+        end
+      end
+
+      context 'when user filled form with invalid parameters' do
+        before do
+          click_button 'Create cluster'
+        end
+
+        it 'user sees a validation error' do
+          expect(page).to have_css('#error_explanation')
+        end
+      end
+    end
+
+    context 'when user has a cluster and visits cluster index page' do
+      let!(:cluster) { create(:gcp_cluster, :created_on_gke, :with_kubernetes_service, project: project) }
+
+      before do
+        visit project_clusters_path(project)
+      end
+
+      it 'user sees an cluster details page' do
+        expect(page).to have_button('Save changes')
+        expect(page.find(:css, '.cluster-name').value).to eq(cluster.gcp_cluster_name)
+      end
+
+      context 'when user disables the cluster' do
+        before do
+          page.find(:css, '.js-toggle-cluster').click
+          click_button 'Save changes'
+        end
+
+        it 'user sees the succeccful message' do
+          expect(page).to have_content('Cluster was successfully updated.')
+        end
+      end
+
+      context 'when user destory the cluster' do
+        before do
+          page.accept_confirm do
+            click_link 'Remove integration'
+          end
+        end
+
+        it 'user sees creation form with the succeccful message' do
+          expect(page).to have_content('Cluster was successfully removed.')
+          expect(page).to have_button('Create cluster')
+        end
+      end
+    end
+  end
+
+  context 'when user has not signed in Google' do
+    before do
+      visit project_clusters_path(project)
+    end
+
+    it 'user sees a login page' do
+      expect(page).to have_css('.signin-with-google')
+    end
+  end
+end
-- 
cgit v1.2.1


From 0ca9ea6e7f09ccaed1d6d55f83a1b81adbc4328a Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 17:04:35 +0200
Subject: Split create_params and update_params and fix small redirect bug in
 controller

---
 app/controllers/projects/clusters_controller.rb | 33 +++++++++++++++----------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 5ee30deee9d..8c0fbf72aca 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -6,6 +6,14 @@ class Projects::ClustersController < Projects::ApplicationController
   before_action :authorize_update_cluster!, only: [:update]
   before_action :authorize_admin_cluster!, only: [:destroy]
 
+  def index
+    if project.cluster
+      redirect_to project_cluster_path(project, project.cluster)
+    else
+      redirect_to new_project_cluster_path(project)
+    end
+  end
+
   def login
     begin
       @authorize_url = GoogleApi::CloudPlatform::Client.new(
@@ -16,25 +24,17 @@ class Projects::ClustersController < Projects::ApplicationController
     end
   end
 
-  def index
-    if project.cluster
-      redirect_to project_cluster_path(project, project.cluster)
-    else
-      redirect_to new_project_cluster_path(project)
-    end
-  end
-
   def new
     @cluster = project.build_cluster
   end
 
   def create
     @cluster = Ci::CreateClusterService
-      .new(project, current_user, cluster_params)
+      .new(project, current_user, create_params)
       .execute(token_in_session)
 
     if @cluster.persisted?
-      redirect_to project_clusters_path(project)
+      redirect_to project_cluster_path(project, @cluster)
     else
       render :new
     end
@@ -57,7 +57,7 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def update
     Ci::UpdateClusterService
-      .new(project, current_user, cluster_params)
+      .new(project, current_user, update_params)
       .execute(cluster)
 
     if cluster.valid?
@@ -84,8 +84,9 @@ class Projects::ClustersController < Projects::ApplicationController
     @cluster ||= project.cluster
   end
 
-  def cluster_params
-    params.require(:cluster).permit(:gcp_project_id,
+  def create_params
+    params.require(:cluster).permit(
+      :gcp_project_id,
       :gcp_cluster_zone,
       :gcp_cluster_name,
       :gcp_cluster_size,
@@ -94,6 +95,12 @@ class Projects::ClustersController < Projects::ApplicationController
       :enabled)
   end
 
+  def update_params
+    params.require(:cluster).permit(
+      :project_namespace,
+      :enabled)
+  end
+
   def authorize_google_api
     unless GoogleApi::CloudPlatform::Client.new(token_in_session, nil)
                                            .validate_token(expires_at_in_session)
-- 
cgit v1.2.1


From d8dd7147b5a88818d159499df9b08c43ce95126e Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 17:05:09 +0200
Subject: Cluster can be read only by master

---
 app/policies/project_policy.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index b9894284226..f599eab42f2 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -164,7 +164,6 @@ class ProjectPolicy < BasePolicy
     enable :create_pipeline
     enable :update_pipeline
     enable :create_pipeline_schedule
-    enable :read_cluster
     enable :create_merge_request
     enable :create_wiki
     enable :push_code
@@ -189,12 +188,13 @@ class ProjectPolicy < BasePolicy
     enable :admin_build
     enable :admin_container_image
     enable :admin_pipeline
-    enable :create_cluster
     enable :admin_environment
     enable :admin_deployment
     enable :admin_pages
     enable :read_pages
     enable :update_pages
+    enable :read_cluster
+    enable :create_cluster
   end
 
   rule { can?(:public_user_access) }.policy do
-- 
cgit v1.2.1


From e15fc89dd8f57f50cc5c15e6ad832eb2ebc6e985 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 17:05:29 +0200
Subject: Added cluster controller specs

---
 app/services/ci/update_cluster_service.rb          |   2 +-
 .../projects/clusters_controller_spec.rb           | 310 +++++++++++++++++++++
 spec/fixtures/api/schemas/cluster_status.json      |  11 +
 3 files changed, 322 insertions(+), 1 deletion(-)
 create mode 100644 spec/controllers/projects/clusters_controller_spec.rb
 create mode 100644 spec/fixtures/api/schemas/cluster_status.json

diff --git a/app/services/ci/update_cluster_service.rb b/app/services/ci/update_cluster_service.rb
index a517d6be0c7..70d88fca660 100644
--- a/app/services/ci/update_cluster_service.rb
+++ b/app/services/ci/update_cluster_service.rb
@@ -2,7 +2,7 @@ module Ci
   class UpdateClusterService < BaseService
     def execute(cluster)
       Gcp::Cluster.transaction do
-        cluster.update!(enabled: params['enabled'])
+        cluster.update!(params)
 
         if params['enabled'] == 'true'
           cluster.service.update!(
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
new file mode 100644
index 00000000000..af182a20f14
--- /dev/null
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -0,0 +1,310 @@
+require 'spec_helper'
+
+describe Projects::ClustersController do
+  set(:user) { create(:user) }
+  set(:project) { create(:project) }
+  let(:role) { :master }
+
+  before do
+    project.team << [user, role]
+
+    sign_in(user)
+  end
+
+  describe 'GET index' do
+    subject do
+      get :index, namespace_id: project.namespace,
+                  project_id: project
+    end
+
+    context 'when cluster is already created' do
+      let!(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+      it 'redirects to show a cluster' do
+        subject
+
+        expect(response).to redirect_to(project_cluster_path(project, cluster))
+      end
+    end
+
+    context 'when we do not have cluster' do
+      it 'redirects to create a cluster' do
+        subject
+
+        expect(response).to redirect_to(new_project_cluster_path(project))
+      end
+    end
+  end
+
+  describe 'GET login' do
+    render_views
+
+    subject do
+      get :login, namespace_id: project.namespace,
+                  project_id: project
+    end
+
+    context 'when we do have omniauth configured' do
+      it 'shows login button' do
+        subject
+
+        expect(response.body).to include('auth_buttons/signin_with_google')
+      end
+    end
+
+    context 'when we do not have omniauth configured' do
+      before do
+        stub_omniauth_setting(providers: [])
+      end
+
+      it 'shows notice message' do
+        subject
+
+        expect(response.body).to include('Ask your GitLab administrator if you want to use this service.')
+      end
+    end
+  end
+
+  shared_examples 'requires to login' do
+    it 'redirects to create a cluster' do
+      subject
+
+      expect(response).to redirect_to(login_project_clusters_path(project))
+    end
+  end
+
+  describe 'GET new' do
+    render_views
+
+    subject do
+      get :new, namespace_id: project.namespace,
+                project_id: project
+    end
+
+    context 'when logged' do
+      before do
+        make_logged_in
+      end
+
+      it 'shows a creation form' do
+        subject
+
+        expect(response.body).to include('Create cluster')
+      end
+    end
+
+    context 'when not logged' do
+      it_behaves_like 'requires to login'
+    end
+  end
+
+  describe 'POST create' do
+    subject do
+      post :create, params.merge(
+                      namespace_id: project.namespace,
+                      project_id: project)
+    end
+
+    context 'when not logged' do
+      let(:params) { {} }
+
+      it_behaves_like 'requires to login'
+    end
+
+    context 'when logged in' do
+      before do
+        make_logged_in
+      end
+
+      context 'when all required parameters are set' do
+        let(:params) do 
+          {
+            cluster: {
+              gcp_cluster_name: 'new-cluster',
+              gcp_project_id: '111',
+            } 
+          }
+        end
+
+        before do
+          expect(ClusterProvisionWorker).to receive(:perform_async) { }
+        end
+
+        it 'creates a new cluster' do
+          expect { subject }.to change { Gcp::Cluster.count }
+
+          expect(response).to redirect_to(project_cluster_path(project, project.cluster))
+        end
+      end
+
+      context 'when not all required parameters are set' do
+        render_views
+
+        let(:params) do 
+          {
+            cluster: {
+              project_namespace: 'some namespace'
+            }
+          }
+        end
+
+        it 'shows an error message' do
+          expect { subject }.not_to change { Gcp::Cluster.count }
+
+          expect(response).to render_template(:new)
+        end
+      end
+    end
+  end
+
+  describe 'GET status' do
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      get :status, namespace_id: project.namespace,
+                   project_id: project,
+                   id: cluster,
+                   format: :json
+    end
+
+    it "responds with matching schema" do
+      subject
+
+      expect(response).to have_http_status(:ok)
+      expect(response).to match_response_schema('cluster_status')
+    end
+  end
+
+  describe 'GET show' do
+    render_views
+
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      get :show, namespace_id: project.namespace,
+                 project_id: project,
+                 id: cluster
+    end
+
+    context 'when logged as master' do
+      it "allows to update cluster" do
+        subject
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Save changes")
+      end
+
+      it "allows remove integration" do
+        subject
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Remove integration")
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to access page" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'PUT update' do
+    render_views
+
+    let(:service) { project.build_kubernetes_service }
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project, service: service) }
+    let(:params) { {} }
+
+    subject do
+      put :update, params.merge(
+                     namespace_id: project.namespace,
+                     project_id: project,
+                     id: cluster)
+    end
+
+    context 'when logged as master' do
+      context 'when valid params are used' do
+        let(:params) do
+          {
+            cluster: { enabled: false }
+          }
+        end
+
+        it "redirects back to show page" do
+          subject
+
+          expect(response).to redirect_to(project_cluster_path(project, project.cluster))
+          expect(flash[:notice]).to eq('Cluster was successfully updated.')
+        end
+      end
+
+      context 'when invalid params are used' do
+        let(:params) do
+          {
+            cluster: { project_namespace: 'my Namespace 321321321 #' }
+          }
+        end
+
+        it "rejects changes" do
+          subject
+
+          expect(response).to have_http_status(:ok)
+          expect(response).to render_template(:show)
+        end
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to update cluster" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'delete update' do
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      delete :destroy, namespace_id: project.namespace,
+                       project_id: project,
+                       id: cluster
+    end
+
+    context 'when logged as master' do
+      it "redirects back to clusters list" do
+        subject
+
+        expect(response).to redirect_to(project_clusters_path(project))
+        expect(flash[:notice]).to eq('Cluster was successfully removed.')
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to destroy cluster" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  def make_logged_in
+    session[GoogleApi::CloudPlatform::Client.session_key_for_token] = '1234'
+    session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] = in_hour.to_i.to_s
+  end
+
+  def in_hour
+    Time.now + 1.hour
+  end
+end
diff --git a/spec/fixtures/api/schemas/cluster_status.json b/spec/fixtures/api/schemas/cluster_status.json
new file mode 100644
index 00000000000..1f255a17881
--- /dev/null
+++ b/spec/fixtures/api/schemas/cluster_status.json
@@ -0,0 +1,11 @@
+{
+  "type": "object",
+  "required" : [
+    "status"
+  ],
+  "properties" : {
+    "status": { "type": "string" },
+    "status_reason": { "type": ["string", "null"] }
+  },
+  "additionalProperties": false
+}
-- 
cgit v1.2.1


From 2178cd44c59effb67cef0743064a75f5073c9f45 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 17:09:00 +0200
Subject: Optimise gcp_clusters table schema

---
 db/migrate/20170924094327_create_gcp_clusters.rb | 16 ++++++++++------
 db/schema.rb                                     |  8 ++++----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/db/migrate/20170924094327_create_gcp_clusters.rb b/db/migrate/20170924094327_create_gcp_clusters.rb
index 42171be7fc4..657dddcbbc4 100644
--- a/db/migrate/20170924094327_create_gcp_clusters.rb
+++ b/db/migrate/20170924094327_create_gcp_clusters.rb
@@ -3,13 +3,21 @@ class CreateGcpClusters < ActiveRecord::Migration
 
   def change
     create_table :gcp_clusters do |t|
+      # Order columns by best align scheme
       t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
       t.references :user, foreign_key: { on_delete: :nullify }
       t.references :service, foreign_key: { on_delete: :nullify }
+      t.integer :status
+      t.integer :gcp_cluster_size, null: false
 
-      # General
+      # Timestamps
+      t.datetime_with_timezone :created_at, null: false
+      t.datetime_with_timezone :updated_at, null: false
+
+      # Enable/disable
       t.boolean :enabled, default: true
-      t.integer :status
+
+      # General
       t.text :status_reason
 
       # k8s integration specific
@@ -28,14 +36,10 @@ class CreateGcpClusters < ActiveRecord::Migration
       t.string :gcp_project_id, null: false
       t.string :gcp_cluster_zone, null: false
       t.string :gcp_cluster_name, null: false
-      t.integer :gcp_cluster_size, null: false
       t.string :gcp_machine_type
       t.string :gcp_operation_id
       t.text :encrypted_gcp_token
       t.string :encrypted_gcp_token_iv
-
-      t.datetime_with_timezone :created_at, null: false
-      t.datetime_with_timezone :updated_at, null: false
     end
   end
 end
diff --git a/db/schema.rb b/db/schema.rb
index 00a52c1dffe..5f8f4bb7d5e 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -583,8 +583,11 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.integer "project_id", null: false
     t.integer "user_id"
     t.integer "service_id"
-    t.boolean "enabled", default: true
     t.integer "status"
+    t.integer "gcp_cluster_size", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
+    t.boolean "enabled", default: true
     t.text "status_reason"
     t.string "project_namespace"
     t.string "endpoint"
@@ -597,13 +600,10 @@ ActiveRecord::Schema.define(version: 20171004121444) do
     t.string "gcp_project_id", null: false
     t.string "gcp_cluster_zone", null: false
     t.string "gcp_cluster_name", null: false
-    t.integer "gcp_cluster_size", null: false
     t.string "gcp_machine_type"
     t.string "gcp_operation_id"
     t.text "encrypted_gcp_token"
     t.string "encrypted_gcp_token_iv"
-    t.datetime_with_timezone "created_at", null: false
-    t.datetime_with_timezone "updated_at", null: false
   end
 
   add_index "gcp_clusters", ["project_id"], name: "index_gcp_clusters_on_project_id", unique: true, using: :btree
-- 
cgit v1.2.1


From 5595d73763caf224df4109ab2d52e616cd843d49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 5 Oct 2017 10:17:18 -0500
Subject: Small refactor and fix for RuboCop

---
 app/models/gpg_signature.rb                                      | 9 +++------
 ...171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb | 6 ++++--
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index b718e8e1000..675e7a2456d 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -22,14 +22,11 @@ class GpgSignature < ActiveRecord::Base
   validates :gpg_key_primary_keyid, presence: true
 
   def self.with_key_and_subkeys(gpg_key)
-    return none unless gpg_key
-
-    t = arel_table
-    subkey_ids = gpg_key&.subkeys&.pluck(:id)
+    subkey_ids = gpg_key.subkeys.pluck(:id)
 
     where(
-      t[:gpg_key_id].eq(gpg_key&.id).or(
-        t[:gpg_key_subkey_id].in(subkey_ids)
+      arel_table[:gpg_key_id].eq(gpg_key.id).or(
+        arel_table[:gpg_key_subkey_id].in(subkey_ids)
       )
     )
   end
diff --git a/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
index c8bbfbccc08..08c9ce1d3bb 100644
--- a/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
+++ b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
@@ -8,11 +8,13 @@ class ScheduleCreateGpgKeySubkeysFromGpgKeys < ActiveRecord::Migration
 
   class GpgKey < ActiveRecord::Base
     self.table_name = 'gpg_keys'
+
+    include EachBatch
   end
 
   def up
-    GpgKey.select(:id).in_batches do |relation|
-      jobs = relation.pluck(:id).map do |id|
+    GpgKey.select(:id).each_batch do |gpg_keys|
+      jobs = gpg_keys.pluck(:id).map do |id|
         ['CreateGpgKeySubkeysFromGpgKeys', [id]]
       end
 
-- 
cgit v1.2.1


From 0fbe0406fd7ced45939c79bcdd1fcbac08ddfa1b Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 17:41:36 +0200
Subject: Change `/google_api/authorizations/` to `/google_api/auth/`.

---
 app/controllers/google_api/authorizations_controller.rb | 2 +-
 app/controllers/projects/clusters_controller.rb         | 2 +-
 config/routes/google_api.rb                             | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 79f49d598af..e4f76fb493e 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -2,7 +2,7 @@ module GoogleApi
   class AuthorizationsController < ApplicationController
     def callback
       token, expires_at = GoogleApi::CloudPlatform::Client
-        .new(nil, callback_google_api_authorizations_url)
+        .new(nil, callback_google_api_auth_url)
         .get_token(params[:code])
 
       session[GoogleApi::CloudPlatform::Client.session_key_for_token] = token
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 8c0fbf72aca..bd286b87a29 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -17,7 +17,7 @@ class Projects::ClustersController < Projects::ApplicationController
   def login
     begin
       @authorize_url = GoogleApi::CloudPlatform::Client.new(
-        nil, callback_google_api_authorizations_url,
+        nil, callback_google_api_auth_url,
         state: namespace_project_clusters_url.to_s).authorize_url
     rescue GoogleApi::Auth::ConfigMissingError
       # no-op
diff --git a/config/routes/google_api.rb b/config/routes/google_api.rb
index 57e15d0d39c..3fb236d3d51 100644
--- a/config/routes/google_api.rb
+++ b/config/routes/google_api.rb
@@ -1,5 +1,5 @@
 namespace :google_api do
-  resource :authorizations, only: [], controller: :authorizations do
+  resource :auth, only: [], controller: :authorizations do
     match :callback, via: [:get, :post]
   end
 end
-- 
cgit v1.2.1


From d27b113b49c90ba7d184f0d7965b63e32d260ebf Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 01:55:32 +0900
Subject: Add changelog

---
 ...re-sm-35954-create-kubernetes-cluster-on-gke-from-k8s-service.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/feature-sm-35954-create-kubernetes-cluster-on-gke-from-k8s-service.yml

diff --git a/changelogs/unreleased/feature-sm-35954-create-kubernetes-cluster-on-gke-from-k8s-service.yml b/changelogs/unreleased/feature-sm-35954-create-kubernetes-cluster-on-gke-from-k8s-service.yml
new file mode 100644
index 00000000000..14b35b6daee
--- /dev/null
+++ b/changelogs/unreleased/feature-sm-35954-create-kubernetes-cluster-on-gke-from-k8s-service.yml
@@ -0,0 +1,5 @@
+---
+title: Create Kubernetes cluster on GKE from k8s service
+merge_request: 14470
+author:
+type: added
-- 
cgit v1.2.1


From 6712762b9d6e0391b1a38ca17cc3d982a336bbf9 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 02:45:15 +0900
Subject: Add ClusterPresenter. Fix Static Analysys.

---
 app/controllers/projects/clusters_controller.rb    |  2 +-
 app/models/gcp/cluster.rb                          |  1 +
 app/presenters/gcp/cluster_presenter.rb            |  9 ++++++
 app/views/projects/clusters/show.html.haml         |  2 +-
 .../projects/clusters_controller_spec.rb           | 20 ++++++-------
 spec/presenters/gcp/cluster_presenter_spec.rb      | 35 ++++++++++++++++++++++
 6 files changed, 56 insertions(+), 13 deletions(-)
 create mode 100644 app/presenters/gcp/cluster_presenter.rb
 create mode 100644 spec/presenters/gcp/cluster_presenter_spec.rb

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index bd286b87a29..77644602b72 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -81,7 +81,7 @@ class Projects::ClustersController < Projects::ApplicationController
   private
 
   def cluster
-    @cluster ||= project.cluster
+    @cluster ||= project.cluster.present(current_user: current_user)
   end
 
   def create_params
diff --git a/app/models/gcp/cluster.rb b/app/models/gcp/cluster.rb
index 0e8b920741d..18bd6a6dcb4 100644
--- a/app/models/gcp/cluster.rb
+++ b/app/models/gcp/cluster.rb
@@ -1,6 +1,7 @@
 module Gcp
   class Cluster < ActiveRecord::Base
     extend Gitlab::Gcp::Model
+    include Presentable
 
     belongs_to :project, inverse_of: :cluster
     belongs_to :user
diff --git a/app/presenters/gcp/cluster_presenter.rb b/app/presenters/gcp/cluster_presenter.rb
new file mode 100644
index 00000000000..f7908f92a37
--- /dev/null
+++ b/app/presenters/gcp/cluster_presenter.rb
@@ -0,0 +1,9 @@
+module Gcp
+  class ClusterPresenter < Gitlab::View::Presenter::Delegated
+    presents :cluster
+
+    def gke_cluster_url
+      "https://console.cloud.google.com/kubernetes/clusters/details/#{gcp_cluster_zone}/#{gcp_cluster_name}"
+    end
+  end
+end
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index 48d9835d588..b7b4c3c389c 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -37,7 +37,7 @@
       %label
         = s_('ClusterIntegration|Google container engine')
       %p
-        - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), '', target: '_blank', rel: 'noopener noreferrer')
+        - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), @cluster.gke_cluster_url, target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
       .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
index af182a20f14..604b92caca6 100644
--- a/spec/controllers/projects/clusters_controller_spec.rb
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -100,9 +100,8 @@ describe Projects::ClustersController do
 
   describe 'POST create' do
     subject do
-      post :create, params.merge(
-                      namespace_id: project.namespace,
-                      project_id: project)
+      post :create, params.merge(namespace_id: project.namespace,
+                                 project_id: project)
     end
 
     context 'when not logged' do
@@ -117,12 +116,12 @@ describe Projects::ClustersController do
       end
 
       context 'when all required parameters are set' do
-        let(:params) do 
+        let(:params) do
           {
             cluster: {
               gcp_cluster_name: 'new-cluster',
-              gcp_project_id: '111',
-            } 
+              gcp_project_id: '111'
+            }
           }
         end
 
@@ -140,7 +139,7 @@ describe Projects::ClustersController do
       context 'when not all required parameters are set' do
         render_views
 
-        let(:params) do 
+        let(:params) do
           {
             cluster: {
               project_namespace: 'some namespace'
@@ -221,10 +220,9 @@ describe Projects::ClustersController do
     let(:params) { {} }
 
     subject do
-      put :update, params.merge(
-                     namespace_id: project.namespace,
-                     project_id: project,
-                     id: cluster)
+      put :update, params.merge(namespace_id: project.namespace,
+                                project_id: project,
+                                id: cluster)
     end
 
     context 'when logged as master' do
diff --git a/spec/presenters/gcp/cluster_presenter_spec.rb b/spec/presenters/gcp/cluster_presenter_spec.rb
new file mode 100644
index 00000000000..8d86dc31582
--- /dev/null
+++ b/spec/presenters/gcp/cluster_presenter_spec.rb
@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe Gcp::ClusterPresenter do
+  let(:project) { create(:project) }
+  let(:cluster) { create(:gcp_cluster, project: project) }
+
+  subject(:presenter) do
+    described_class.new(cluster)
+  end
+
+  it 'inherits from Gitlab::View::Presenter::Delegated' do
+    expect(described_class.superclass).to eq(Gitlab::View::Presenter::Delegated)
+  end
+
+  describe '#initialize' do
+    it 'takes a cluster and optional params' do
+      expect { presenter }.not_to raise_error
+    end
+
+    it 'exposes cluster' do
+      expect(presenter.cluster).to eq(cluster)
+    end
+
+    it 'forwards missing methods to cluster' do
+      expect(presenter.gcp_cluster_zone).to eq(cluster.gcp_cluster_zone)
+    end
+  end
+
+  describe '#gke_cluster_url' do
+    subject { described_class.new(cluster).gke_cluster_url }
+
+    it { is_expected.to include(cluster.gcp_cluster_zone) }
+    it { is_expected.to include(cluster.gcp_cluster_name) }
+  end
+end
-- 
cgit v1.2.1


From 4cda11585c75ce923d357b0dbb91fb393ed8e303 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 21:33:29 +0200
Subject: Fix almost all unresolved comments from Docs and UX review

---
 app/controllers/projects/clusters_controller.rb       |  4 ++--
 app/services/ci/create_cluster_service.rb             |  6 ++++--
 app/views/projects/clusters/_form.html.haml           | 12 ++++++------
 app/views/projects/clusters/_header.html.haml         |  2 +-
 app/views/projects/clusters/_sidebar.html.haml        |  2 +-
 app/views/projects/clusters/login.html.haml           |  3 +++
 app/views/projects/clusters/new.html.haml             |  3 +++
 app/views/projects/clusters/show.html.haml            | 13 ++++++++-----
 app/workers/wait_for_cluster_creation_worker.rb       |  2 +-
 locale/gitlab.pot                                     | 10 +++++-----
 spec/controllers/projects/clusters_controller_spec.rb |  2 +-
 spec/features/projects/clusters_spec.rb               |  4 ++--
 12 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 77644602b72..ce8e73392b8 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -70,10 +70,10 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def destroy
     if cluster.destroy
-      flash[:notice] = "Cluster was successfully removed."
+      flash[:notice] = "Cluster integration was successfully removed."
       redirect_to project_clusters_path(project), status: 302
     else
-      flash[:notice] = "Cluster was not removed."
+      flash[:notice] = "Cluster integration was not removed."
       render :show
     end
   end
diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index d01e167ecc3..f7ee0e468e2 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -3,9 +3,11 @@ module Ci
     def execute(access_token)
       params['gcp_machine_type'] ||= GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
 
-      project.create_cluster(
+      cluster_params =
         params.merge(user: current_user,
-                     gcp_token: access_token)).tap do |cluster|
+                     gcp_token: access_token)
+
+      project.create_cluster(cluster_params).tap do |cluster|
         ClusterProvisionWorker.perform_async(cluster.id) if cluster.persisted?
       end
     end
diff --git a/app/views/projects/clusters/_form.html.haml b/app/views/projects/clusters/_form.html.haml
index b5c4942f528..371cdb1e403 100644
--- a/app/views/projects/clusters/_form.html.haml
+++ b/app/views/projects/clusters/_form.html.haml
@@ -1,8 +1,8 @@
 .row
   .col-sm-8.col-sm-offset-4
     %p
-      -link_to_help_page = link_to(s_('ClusterIntegration|help page'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
-      = s_('ClusterIntegration|Use our %{link_to_help_page} on cluster integration.').html_safe % { link_to_help_page: link_to_help_page}
+      - link_to_help_page = link_to(s_('ClusterIntegration|help page'), help_page_path('user/project/clusters/index'), target: '_blank', rel: 'noopener noreferrer')
+      = s_('ClusterIntegration|Read our %{link_to_help_page} on cluster integration.').html_safe % { link_to_help_page: link_to_help_page}
 
       = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
         = form_errors(@cluster)
@@ -18,16 +18,16 @@
         .form-group
           = field.label :gcp_cluster_zone, s_('ClusterIntegration|Zone')
           = link_to(s_('ClusterIntegration|See zones'), 'https://cloud.google.com/compute/docs/regions-zones/regions-zones', target: '_blank', rel: 'noopener noreferrer')
-          = field.text_field :gcp_cluster_zone, class: 'form-control'
+          = field.text_field :gcp_cluster_zone, class: 'form-control', placeholder: 'us-central1-a'
 
         .form-group
           = field.label :gcp_cluster_size, s_('ClusterIntegration|Number of nodes')
-          = field.text_field :gcp_cluster_size, class: 'form-control'
+          = field.text_field :gcp_cluster_size, class: 'form-control', placeholder: '3'
 
         .form-group
           = field.label :gcp_machine_type, s_('ClusterIntegration|Machine type')
-          = link_to(s_('ClusterIntegration|Machine type'), 'https://cloud.google.com/compute/docs/machine-types', target: '_blank', rel: 'noopener noreferrer')
-          = field.text_field :gcp_machine_type, class: 'form-control'
+          = link_to(s_('ClusterIntegration|See machine types'), 'https://cloud.google.com/compute/docs/machine-types', target: '_blank', rel: 'noopener noreferrer')
+          = field.text_field :gcp_machine_type, class: 'form-control', placeholder: 'n1-standard-4'
 
           .form-group
           = field.label :project_namespace, s_('ClusterIntegration|Project namespace (optional, unique)')
diff --git a/app/views/projects/clusters/_header.html.haml b/app/views/projects/clusters/_header.html.haml
index b3b98ea04f6..0134d46491c 100644
--- a/app/views/projects/clusters/_header.html.haml
+++ b/app/views/projects/clusters/_header.html.haml
@@ -1,7 +1,7 @@
 %h4.prepend-top-0
   = s_('ClusterIntegration|Create new cluster on Google Container Engine')
 %p
-  = s_('ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:')
+  = s_('ClusterIntegration|Please make sure that your Google account meets the following requirements:')
 %ul
   %li
     - link_to_container_engine = link_to(s_('ClusterIntegration|access to Google Container Engine'), 'https://console.cloud.google.com', target: '_blank', rel: 'noopener noreferrer')
diff --git a/app/views/projects/clusters/_sidebar.html.haml b/app/views/projects/clusters/_sidebar.html.haml
index 0d744f1b028..761879db32b 100644
--- a/app/views/projects/clusters/_sidebar.html.haml
+++ b/app/views/projects/clusters/_sidebar.html.haml
@@ -3,5 +3,5 @@
 %p
   = s_('ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way.')
 %p
-  - link = link_to(s_('ClusterIntegration|cluster'), help_page_path('TODO'), target: '_blank', rel: 'noopener noreferrer')
+  - link = link_to(s_('ClusterIntegration|cluster'), help_page_path('user/project/clusters/index'), target: '_blank', rel: 'noopener noreferrer')
   = s_('ClusterIntegration|Learn more about %{link_to_documentation}').html_safe % { link_to_documentation: link }
diff --git a/app/views/projects/clusters/login.html.haml b/app/views/projects/clusters/login.html.haml
index 5023abc5aa0..ae132672b7e 100644
--- a/app/views/projects/clusters/login.html.haml
+++ b/app/views/projects/clusters/login.html.haml
@@ -1,3 +1,6 @@
+- breadcrumb_title "Cluster"
+- page_title _("Login")
+
 .row.prepend-top-default
   .col-sm-4
     = render 'sidebar'
diff --git a/app/views/projects/clusters/new.html.haml b/app/views/projects/clusters/new.html.haml
index 4b7214b3c62..c538d41ffad 100644
--- a/app/views/projects/clusters/new.html.haml
+++ b/app/views/projects/clusters/new.html.haml
@@ -1,3 +1,6 @@
+- breadcrumb_title "Cluster"
+- page_title _("New Cluster")
+
 .row.prepend-top-default
   .col-sm-4
     = render 'sidebar'
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index b7b4c3c389c..651388ebde7 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -1,8 +1,11 @@
+- breadcrumb_title "Cluster"
+- page_title _("Cluster")
+
 - status_path = status_namespace_project_cluster_path(@cluster.project.namespace, @cluster.project, @cluster.id, format: :json) if can?(current_user, :admin_cluster, @cluster) && @cluster.on_creation?
 .row.prepend-top-default.edit-cluster-form.js-edit-cluster-form{ data: { status_path: status_path,
   toggle_status: @cluster.enabled? ? 'true': 'false',
   cluster_status: @cluster.status_name,
-  cluster_status_reason: @cluster.status_reason }}
+  cluster_status_reason: @cluster.status_reason } }
   .col-sm-4
     = render 'sidebar'
   .col-sm-8
@@ -35,26 +38,26 @@
 
     - if can?(current_user, :admin_cluster, @cluster)
       %label
-        = s_('ClusterIntegration|Google container engine')
+        = s_('ClusterIntegration|Google Container Engine')
       %p
         - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), @cluster.gke_cluster_url, target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
       .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
-        = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine.')
+        = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine')
         %p.js-error-reason
 
       .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
         = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
       .hidden.js-cluster-success.alert.alert-info{ role: 'alert' }
-        = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine.')
+        = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine')
 
     .form_group
       %label{ for: 'cluter_name' }
         = s_('ClusterIntegration|Cluster name')
       .input-group
-        %input.form-control.cluster-name{ value: @cluster.gcp_cluster_name, disabled: true}
+        %input.form-control.cluster-name{ value: @cluster.gcp_cluster_name, disabled: true }
         %span.input-group-addon.clipboard-addon
           = clipboard_button(text: @cluster.gcp_cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
 
diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index f72bf409b20..eab340070e1 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -7,7 +7,7 @@ class WaitForClusterCreationWorker
   TIMEOUT = 20.minutes
 
   def perform(cluster_id)
-    Gcp::Cluster.find_by_id(cluster_id).tap do |cluster|
+    Gcp::Cluster.find_by_id(cluster_id).try do |cluster|
       Ci::FetchGcpOperationService.new.execute(cluster) do |operation|
         case operation.status
         when 'RUNNING'
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 5c26f942b02..7569af9d175 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -388,7 +388,7 @@ msgstr ""
 msgid "ClusterIntegration|Cluster name"
 msgstr ""
 
-msgid "ClusterIntegration|Cluster was successfully created on Google Container Engine."
+msgid "ClusterIntegration|Cluster was successfully created on Google Container Engine"
 msgstr ""
 
 msgid "ClusterIntegration|Copy cluster name"
@@ -412,13 +412,13 @@ msgstr ""
 msgid "ClusterIntegration|Google Container Engine project"
 msgstr ""
 
-msgid "ClusterIntegration|Google container engine"
+msgid "ClusterIntegration|Google Container Engine"
 msgstr ""
 
 msgid "ClusterIntegration|Learn more about %{link_to_documentation}"
 msgstr ""
 
-msgid "ClusterIntegration|Machine type"
+msgid "ClusterIntegration|See machine types"
 msgstr ""
 
 msgid "ClusterIntegration|Make sure your account %{link_to_requirements} to create clusters"
@@ -457,13 +457,13 @@ msgstr ""
 msgid "ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine."
 msgstr ""
 
-msgid "ClusterIntegration|To create a new cluster on Google Container Engine, please sign in with your Google account:"
+msgid "ClusterIntegration|Please make sure that your Google account meets the following requirements:"
 msgstr ""
 
 msgid "ClusterIntegration|Toggle Cluster"
 msgstr ""
 
-msgid "ClusterIntegration|Use our %{link_to_help_page} on cluster integration."
+msgid "ClusterIntegration|Read our %{link_to_help_page} on cluster integration."
 msgstr ""
 
 msgid "ClusterIntegration|With a cluster associated to this project, you can use review apps, deploy your applications, run your pipelines, and much more in an easy way."
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
index 604b92caca6..b34702370e8 100644
--- a/spec/controllers/projects/clusters_controller_spec.rb
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -282,7 +282,7 @@ describe Projects::ClustersController do
         subject
 
         expect(response).to redirect_to(project_clusters_path(project))
-        expect(flash[:notice]).to eq('Cluster was successfully removed.')
+        expect(flash[:notice]).to eq('Cluster integration was successfully removed.')
       end
     end
 
diff --git a/spec/features/projects/clusters_spec.rb b/spec/features/projects/clusters_spec.rb
index b836427513d..7f33629c938 100644
--- a/spec/features/projects/clusters_spec.rb
+++ b/spec/features/projects/clusters_spec.rb
@@ -46,7 +46,7 @@ feature 'Clusters', :js do
 
           Gcp::Cluster.last.make_created!
 
-          expect(page).to have_content('Cluster was successfully created on Google Container Engine.')
+          expect(page).to have_content('Cluster was successfully created on Google Container Engine')
         end
       end
 
@@ -92,7 +92,7 @@ feature 'Clusters', :js do
         end
 
         it 'user sees creation form with the succeccful message' do
-          expect(page).to have_content('Cluster was successfully removed.')
+          expect(page).to have_content('Cluster integration was successfully removed.')
           expect(page).to have_button('Create cluster')
         end
       end
-- 
cgit v1.2.1


From 7d00296cb1a831927442002b51ac15da9355dcf6 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Thu, 5 Oct 2017 22:24:07 +0200
Subject: Refactor discussion lock docs

---
 doc/user/discussions/index.md | 30 ++++++++++++++++++++----------
 doc/user/permissions.md       |  1 +
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/doc/user/discussions/index.md b/doc/user/discussions/index.md
index f3c51d95513..ab46befb91c 100644
--- a/doc/user/discussions/index.md
+++ b/doc/user/discussions/index.md
@@ -157,31 +157,41 @@ comments in greater detail.
 
 > [Introduced][ce-14531] in GitLab 10.1.
 
-When the discussion of an issue or a merge request is locked only team members can write new comments and edit the old ones.
+There might be some cases where a discussion is better off if it's locked down.
+For example:
 
-### Modifying discussion lock
+- Discussions that are several years old and the issue/merge request is closed,
+  but people continue to try to resurrect the discussion.
+- Discussions where someone or a group of people are trolling, are abusive, or
+  in-general are causing the discussion to be unproductive.
 
-To lock or unlock a dicsussion, find the Lock section in the sidebar and click **Edit**. A popup should appear and give you the option to turn on or turn off the discussion lock.
+In locked discussions, only team members can write new comments and edit the old
+ones.
+
+To lock or unlock a discussion, you need to have at least Master [permissions]:
+
+1. Find the "Lock" section in the sidebar and click **Edit**
+1. In the dialog that will appear, you can choose to turn on or turn off the
+   discussion lock
+1. Optionally, leave a comment to explain your reasoning behind that action
 
 | Turn off discussion lock | Turn on discussion lock |
 | :-----------: | :----------: |
 | ![Turn off discussion lock](img/turn_off_lock.png) | ![Turn on discussion lock](img/turn_on_lock.png) |
 
-Every change is indicated by a system note in the issue's or merge request's comments.
+Every change is indicated by a system note in the issue's or merge request's
+comments.
 
 ![Discussion lock system notes](img/discussion_lock_system_notes.png)
 
-### Indications of locked issues or merge requests
-
-While you are inside the locked issue or merge request and you are a project team member you can see an indicator in the comment form that the issue or merge request is locked.
-
-If you are not a team member you won't see the comment form but only the information that the dicussion is locked.
+Once an issue or merge request is locked, project members can see the indicator
+in the comment area, whereas non project members can only see the information
+that the discussion is locked.
 
 | Team member | Not a member |
 | :-----------: | :----------: |
 | ![Comment form member](img/lock_form_member.png) | ![Comment form non-member](img/lock_form_non_member.png) |
 
-
 [ce-5022]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022
 [ce-7125]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7125
 [ce-7527]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7527
diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 44ee994a26b..aa1fa60a492 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -25,6 +25,7 @@ The following table depicts the various user permission levels in a project.
 | Create confidential issue             | ✓ [^1]  | ✓          | ✓           | ✓        | ✓      |
 | View confidential issues              | (✓) [^2] | ✓          | ✓           | ✓        | ✓      |
 | Leave comments                        | ✓ [^1]  | ✓          | ✓           | ✓        | ✓      |
+| Lock comments                         |         |            |             | ✓        | ✓      |
 | See a list of jobs                    | ✓ [^3]  | ✓          | ✓           | ✓        | ✓      |
 | See a job   log                       | ✓ [^3]  | ✓          | ✓           | ✓        | ✓      |
 | Download and browse job artifacts     | ✓ [^3]  | ✓          | ✓           | ✓        | ✓      |
-- 
cgit v1.2.1


From 60a35e4230404b84d4aee8015fb7821b0b194277 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Rodr=C3=ADguez?= <alejorro70@gmail.com>
Date: Mon, 2 Oct 2017 21:52:19 -0300
Subject: Send API parameters as extra data for sentry errors

---
 config/initializers/sentry.rb     |  4 +++-
 lib/api/helpers.rb                |  2 +-
 spec/requests/api/helpers_spec.rb | 28 +++++++++++++++++++++++++++-
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/config/initializers/sentry.rb b/config/initializers/sentry.rb
index 62d0967009a..b2da3b3dc19 100644
--- a/config/initializers/sentry.rb
+++ b/config/initializers/sentry.rb
@@ -2,7 +2,7 @@
 
 require 'gitlab/current_settings'
 
-if Rails.env.production?
+def configure_sentry
   # allow it to fail: it may do so when create_from_defaults is executed before migrations are actually done
   begin
     sentry_enabled = Gitlab::CurrentSettings.current_application_settings.sentry_enabled
@@ -23,3 +23,5 @@ if Rails.env.production?
     end
   end
 end
+
+configure_sentry if Rails.env.production?
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 4964a76bef6..a87297a604c 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -287,7 +287,7 @@ module API
       if sentry_enabled? && report_exception?(exception)
         define_params_for_grape_middleware
         sentry_context
-        Raven.capture_exception(exception)
+        Raven.capture_exception(exception, extra: params)
       end
 
       # lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb
index 060c8902471..862920ad7c3 100644
--- a/spec/requests/api/helpers_spec.rb
+++ b/spec/requests/api/helpers_spec.rb
@@ -1,4 +1,6 @@
 require 'spec_helper'
+require 'raven/transports/dummy'
+require_relative '../../../config/initializers/sentry'
 
 describe API::Helpers do
   include API::APIGuard::HelperMethods
@@ -476,7 +478,7 @@ describe API::Helpers do
       allow(exception).to receive(:backtrace).and_return(caller)
 
       expect_any_instance_of(self.class).to receive(:sentry_context)
-      expect(Raven).to receive(:capture_exception).with(exception)
+      expect(Raven).to receive(:capture_exception).with(exception, extra: {})
 
       handle_api_exception(exception)
     end
@@ -501,6 +503,30 @@ describe API::Helpers do
         expect(json_response['message']).to start_with("\nRuntimeError (Runtime Error!):")
       end
     end
+
+    context 'extra information' do
+      # Sentry events are an array of the form [auth_header, data, options]
+      let(:event_data) { Raven.client.transport.events.first[1] }
+
+      before do
+        stub_application_setting(
+          sentry_enabled: true,
+          sentry_dsn: "dummy://12345:67890@sentry.localdomain/sentry/42"
+        )
+        configure_sentry
+        Raven.client.configuration.encoding = 'json'
+      end
+
+      it 'sends the params, excluding confidential values' do
+        expect(Gitlab::Sentry).to receive(:enabled?).twice.and_return(true)
+        expect(ProjectsFinder).to receive(:new).and_raise('Runtime Error!')
+
+        get api('/projects', user), password: 'dont_send_this', other_param: 'send_this'
+
+        expect(event_data).to include('other_param=send_this')
+        expect(event_data).to include('password=********')
+      end
+    end
   end
 
   describe '.authenticate_non_get!' do
-- 
cgit v1.2.1


From 3f3e4dd1d35ee059e8b35022c8cc4ba60bba16a0 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 23:52:24 +0200
Subject: Fix failing spec

---
 spec/workers/wait_for_cluster_creation_worker_spec.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
index 489dd769c12..c60dfb9dd4c 100644
--- a/spec/workers/wait_for_cluster_creation_worker_spec.rb
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -56,9 +56,9 @@ describe WaitForClusterCreationWorker do
 
     context 'when cluster does not exist' do
       it 'does not provision a cluster' do
-        expect_any_instance_of(Ci::FetchGcpOperationService).to receive(:execute).with(nil)
+        expect_any_instance_of(Ci::FetchGcpOperationService).not_to receive(:execute)
 
-        described_class.new.perform(123)
+        described_class.new.perform(1234)
       end
     end
   end
-- 
cgit v1.2.1


From 354e2ef08df3c704ca325415116587440260f67b Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Thu, 5 Oct 2017 23:54:26 +0200
Subject: Add some empty spaces

---
 spec/workers/wait_for_cluster_creation_worker_spec.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
index c60dfb9dd4c..6d82981287f 100644
--- a/spec/workers/wait_for_cluster_creation_worker_spec.rb
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -29,6 +29,7 @@ describe WaitForClusterCreationWorker do
 
           it 'sets an error message on cluster' do
             described_class.new.perform(cluster.id)
+
             expect(cluster.reload).to be_errored
           end
         end
@@ -49,6 +50,7 @@ describe WaitForClusterCreationWorker do
 
         it 'sets an error message on cluster' do
           described_class.new.perform(cluster.id)
+
           expect(cluster.reload).to be_errored
         end
       end
-- 
cgit v1.2.1


From 351fde1b908296802fe65112f2ff1eb4aa6cb5db Mon Sep 17 00:00:00 2001
From: Jacob Schatz <jschatz1@gmail.com>
Date: Thu, 5 Oct 2017 11:05:48 -0400
Subject: Prevent branches or tags from starting with invalid characters (e.g.
 -, .)

Closes #38817
---
 changelogs/unreleased/valid-branch-name-dash-bug.yml | 5 +++++
 lib/gitlab/git_ref_validator.rb                      | 2 +-
 spec/lib/gitlab/git_ref_validator_spec.rb            | 5 +++++
 3 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/valid-branch-name-dash-bug.yml

diff --git a/changelogs/unreleased/valid-branch-name-dash-bug.yml b/changelogs/unreleased/valid-branch-name-dash-bug.yml
new file mode 100644
index 00000000000..89e4578b3e5
--- /dev/null
+++ b/changelogs/unreleased/valid-branch-name-dash-bug.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent branches or tags from starting with invalid characters (e.g. -, .)
+merge_request:
+author:
+type: fixed
diff --git a/lib/gitlab/git_ref_validator.rb b/lib/gitlab/git_ref_validator.rb
index a3c6b21a6a1..2e3e4fc3f1f 100644
--- a/lib/gitlab/git_ref_validator.rb
+++ b/lib/gitlab/git_ref_validator.rb
@@ -11,7 +11,7 @@ module Gitlab
       return false if ref_name.start_with?('refs/remotes/')
 
       Gitlab::Utils.system_silent(
-        %W(#{Gitlab.config.git.bin_path} check-ref-format refs/#{ref_name}))
+        %W(#{Gitlab.config.git.bin_path} check-ref-format --branch #{ref_name}))
     end
   end
 end
diff --git a/spec/lib/gitlab/git_ref_validator_spec.rb b/spec/lib/gitlab/git_ref_validator_spec.rb
index e1fa8ae03f8..ba7fb168a3b 100644
--- a/spec/lib/gitlab/git_ref_validator_spec.rb
+++ b/spec/lib/gitlab/git_ref_validator_spec.rb
@@ -4,6 +4,7 @@ describe Gitlab::GitRefValidator do
   it { expect(described_class.validate('feature/new')).to be_truthy }
   it { expect(described_class.validate('implement_@all')).to be_truthy }
   it { expect(described_class.validate('my_new_feature')).to be_truthy }
+  it { expect(described_class.validate('my-branch')).to be_truthy }
   it { expect(described_class.validate('#1')).to be_truthy }
   it { expect(described_class.validate('feature/refs/heads/foo')).to be_truthy }
   it { expect(described_class.validate('feature/~new/')).to be_falsey }
@@ -22,4 +23,8 @@ describe Gitlab::GitRefValidator do
   it { expect(described_class.validate('refs/remotes/')).to be_falsey }
   it { expect(described_class.validate('refs/heads/feature')).to be_falsey }
   it { expect(described_class.validate('refs/remotes/origin')).to be_falsey }
+  it { expect(described_class.validate('-')).to be_falsey }
+  it { expect(described_class.validate('-branch')).to be_falsey }
+  it { expect(described_class.validate('.tag')).to be_falsey }
+  it { expect(described_class.validate('my branch')).to be_falsey }
 end
-- 
cgit v1.2.1


From 555f50b3e68e82968ea2eb4916a3f5beeeef7b31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Thu, 5 Oct 2017 22:43:44 -0500
Subject: Add more specs.

---
 ...chedule_create_gpg_key_subkeys_from_gpg_keys.rb |  3 +-
 .../create_gpg_key_subkeys_from_gpg_keys_spec.rb   | 32 ++++++++++
 .../gpg/invalid_gpg_signature_updater_spec.rb      | 49 +++++++++++----
 spec/lib/gitlab/gpg_spec.rb                        | 17 +++++
 ...le_create_gpg_key_subkeys_from_gpg_keys_spec.rb | 43 +++++++++++++
 spec/support/gpg_helpers.rb                        | 73 ++++++++++++++++++++++
 6 files changed, 203 insertions(+), 14 deletions(-)
 create mode 100644 spec/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys_spec.rb
 create mode 100644 spec/migrations/schedule_create_gpg_key_subkeys_from_gpg_keys_spec.rb

diff --git a/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
index 08c9ce1d3bb..01d56fbd490 100644
--- a/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
+++ b/db/post_migrate/20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys.rb
@@ -5,6 +5,7 @@ class ScheduleCreateGpgKeySubkeysFromGpgKeys < ActiveRecord::Migration
   disable_ddl_transaction!
 
   DOWNTIME = false
+  MIGRATION = 'CreateGpgKeySubkeysFromGpgKeys'
 
   class GpgKey < ActiveRecord::Base
     self.table_name = 'gpg_keys'
@@ -15,7 +16,7 @@ class ScheduleCreateGpgKeySubkeysFromGpgKeys < ActiveRecord::Migration
   def up
     GpgKey.select(:id).each_batch do |gpg_keys|
       jobs = gpg_keys.pluck(:id).map do |id|
-        ['CreateGpgKeySubkeysFromGpgKeys', [id]]
+        [MIGRATION, [id]]
       end
 
       BackgroundMigrationWorker.perform_bulk(jobs)
diff --git a/spec/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys_spec.rb b/spec/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys_spec.rb
new file mode 100644
index 00000000000..26d48cc8201
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/create_gpg_key_subkeys_from_gpg_keys_spec.rb
@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe Gitlab::BackgroundMigration::CreateGpgKeySubkeysFromGpgKeys, :migration, schema: 20171005130944 do
+  context 'when GpgKey exists' do
+    let!(:gpg_key) { create(:gpg_key, key: GpgHelpers::User3.public_key) }
+
+    before do
+      GpgKeySubkey.destroy_all
+    end
+
+    it 'generate the subkeys' do
+      expect do
+        described_class.new.perform(gpg_key.id)
+      end.to change { gpg_key.subkeys.count }.from(0).to(2)
+    end
+
+    it 'schedules the signature update worker' do
+      expect(InvalidGpgSignatureUpdateWorker).to receive(:perform_async).with(gpg_key.id)
+
+      described_class.new.perform(gpg_key.id)
+    end
+  end
+
+  context 'when GpgKey does not exist' do
+    it 'does not do anything' do
+      expect(Gitlab::Gpg).not_to receive(:subkeys_from_key)
+      expect(InvalidGpgSignatureUpdateWorker).not_to receive(:perform_async)
+
+      described_class.new.perform(123)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/gpg/invalid_gpg_signature_updater_spec.rb b/spec/lib/gitlab/gpg/invalid_gpg_signature_updater_spec.rb
index b9fd4d02156..d6000af0ecd 100644
--- a/spec/lib/gitlab/gpg/invalid_gpg_signature_updater_spec.rb
+++ b/spec/lib/gitlab/gpg/invalid_gpg_signature_updater_spec.rb
@@ -2,17 +2,16 @@ require 'rails_helper'
 
 RSpec.describe Gitlab::Gpg::InvalidGpgSignatureUpdater do
   describe '#run' do
-    let!(:commit_sha) { '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33' }
-    let!(:project) { create :project, :repository, path: 'sample-project' }
+    let(:signature)       { [GpgHelpers::User1.signed_commit_signature, GpgHelpers::User1.signed_commit_base_data] }
+    let(:committer_email) { GpgHelpers::User1.emails.first }
+    let!(:commit_sha)     { '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33' }
+    let!(:project)        { create :project, :repository, path: 'sample-project' }
     let!(:raw_commit) do
       raw_commit = double(
         :raw_commit,
-        signature: [
-          GpgHelpers::User1.signed_commit_signature,
-          GpgHelpers::User1.signed_commit_base_data
-        ],
+        signature: signature,
         sha: commit_sha,
-        committer_email: GpgHelpers::User1.emails.first
+        committer_email: committer_email
       )
 
       allow(raw_commit).to receive :save!
@@ -29,12 +28,7 @@ RSpec.describe Gitlab::Gpg::InvalidGpgSignatureUpdater do
 
       allow(Rugged::Commit).to receive(:extract_signature)
         .with(Rugged::Repository, commit_sha)
-        .and_return(
-          [
-            GpgHelpers::User1.signed_commit_signature,
-            GpgHelpers::User1.signed_commit_base_data
-          ]
-        )
+        .and_return(signature)
     end
 
     context 'gpg signature did have an associated gpg key which was removed later' do
@@ -183,5 +177,34 @@ RSpec.describe Gitlab::Gpg::InvalidGpgSignatureUpdater do
         )
       end
     end
+
+    context 'gpg signature did not have an associated gpg subkey' do
+      let(:signature)       { [GpgHelpers::User3.signed_commit_signature, GpgHelpers::User3.signed_commit_base_data] }
+      let(:committer_email) { GpgHelpers::User3.emails.first }
+      let!(:user)           { create :user, email: GpgHelpers::User3.emails.first }
+
+      let!(:invalid_gpg_signature) do
+        create :gpg_signature,
+          project: project,
+          commit_sha: commit_sha,
+          gpg_key: nil,
+          gpg_key_primary_keyid: GpgHelpers::User3.subkey_fingerprints.last[24..-1],
+          verification_status: 'unknown_key'
+      end
+
+      it 'updates the signature to being valid when the missing gpg key is added' do
+        # InvalidGpgSignatureUpdater is called by the after_create hook
+        gpg_key = create(:gpg_key, key: GpgHelpers::User3.public_key, user: user)
+        subkey = gpg_key.subkeys.last
+
+        expect(invalid_gpg_signature.reload).to have_attributes(
+          project: project,
+          commit_sha: commit_sha,
+          gpg_key_subkey_id: subkey.id,
+          gpg_key_primary_keyid: subkey.keyid,
+          verification_status: 'verified'
+        )
+      end
+    end
   end
 end
diff --git a/spec/lib/gitlab/gpg_spec.rb b/spec/lib/gitlab/gpg_spec.rb
index 11a2aea1915..ab9a166db00 100644
--- a/spec/lib/gitlab/gpg_spec.rb
+++ b/spec/lib/gitlab/gpg_spec.rb
@@ -28,6 +28,23 @@ describe Gitlab::Gpg do
     end
   end
 
+  describe '.subkeys_from_key' do
+    it 'returns the subkeys by primary key' do
+      all_subkeys = described_class.subkeys_from_key(GpgHelpers::User1.public_key)
+      subkeys = all_subkeys[GpgHelpers::User1.primary_keyid]
+
+      expect(subkeys).to be_present
+      expect(subkeys.first[:keyid]).to be_present
+      expect(subkeys.first[:fingerprint]).to be_present
+    end
+
+    it 'returns an empty array when there are not subkeys' do
+      all_subkeys = described_class.subkeys_from_key(GpgHelpers::User4.public_key)
+
+      expect(all_subkeys[GpgHelpers::User4.primary_keyid]).to be_empty
+    end
+  end
+
   describe '.user_infos_from_key' do
     it 'returns the names and emails' do
       user_infos = described_class.user_infos_from_key(GpgHelpers::User1.public_key)
diff --git a/spec/migrations/schedule_create_gpg_key_subkeys_from_gpg_keys_spec.rb b/spec/migrations/schedule_create_gpg_key_subkeys_from_gpg_keys_spec.rb
new file mode 100644
index 00000000000..0e884a7d910
--- /dev/null
+++ b/spec/migrations/schedule_create_gpg_key_subkeys_from_gpg_keys_spec.rb
@@ -0,0 +1,43 @@
+require 'spec_helper'
+require Rails.root.join('db', 'post_migrate', '20171005130944_schedule_create_gpg_key_subkeys_from_gpg_keys')
+
+describe ScheduleCreateGpgKeySubkeysFromGpgKeys, :migration, :sidekiq do
+  matcher :be_scheduled_migration do |*expected|
+    match do |migration|
+      BackgroundMigrationWorker.jobs.any? do |job|
+        job['args'] == [migration, expected]
+      end
+    end
+
+    failure_message do |migration|
+      "Migration `#{migration}` with args `#{expected.inspect}` not scheduled!"
+    end
+  end
+
+  before do
+    create(:gpg_key, id: 1, key: GpgHelpers::User1.public_key)
+    create(:gpg_key, id: 2, key: GpgHelpers::User3.public_key)
+    # Delete all subkeys so they can be recreated
+    GpgKeySubkey.destroy_all
+  end
+
+  it 'correctly schedules background migrations' do
+    Sidekiq::Testing.fake! do
+      migrate!
+
+      expect(described_class::MIGRATION).to be_scheduled_migration(1)
+      expect(described_class::MIGRATION).to be_scheduled_migration(2)
+      expect(BackgroundMigrationWorker.jobs.size).to eq(2)
+    end
+  end
+
+  it 'schedules background migrations' do
+    Sidekiq::Testing.inline! do
+      expect(GpgKeySubkey.count).to eq(0)
+
+      migrate!
+
+      expect(GpgKeySubkey.count).to eq(3)
+    end
+  end
+end
diff --git a/spec/support/gpg_helpers.rb b/spec/support/gpg_helpers.rb
index 4b1ca7ff9c8..3f7279a50e0 100644
--- a/spec/support/gpg_helpers.rb
+++ b/spec/support/gpg_helpers.rb
@@ -441,4 +441,77 @@ module GpgHelpers
       ['john.doe@example.com']
     end
   end
+
+  # GPG Key containing just the main key
+  module User4
+    extend self
+
+    def public_key
+      <<~KEY.strip
+        -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+        mQENBFnWcesBCAC6Y8FXl9ZJ9HPa6dIYcgQrvjIQcwoQCUEsaXNRpc+206RPCIXK
+        aIYr0nTD8GeovMuUONXTj+DdueQU2GAAqHHOqvDDVXqRrW3xfWnSwix7sTuhG1Ew
+        PLHYmjLENqaTsdyliEo3N8VWy2k0QRbC3R6xvop4Ooa87D5vcATIl0gYFtSiHIL+
+        TervYvTG9Eq1qSLZHbe2x4IzeqX2luikPKokL7j8FTZaCmC5MezIUur1ulfyYY/j
+        SkST/1aUFc5QXJJSZA0MYJWZX6x7Y3l7yl0dkHqmK8OTuo8RPWd3ybEiuvRsOL8K
+        GAv/PmVJRGDAf7GGbwXXsE9MiZ5GzVPxHnexABEBAAG0G0pvaG4gRG9lIDxqb2hu
+        QGV4YW1wbGUuY29tPokBTgQTAQgAOBYhBAh0izYM0lwuzJnVlAcBbPnhOj+bBQJZ
+        1nHrAhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEAcBbPnhOj+bkywH/i4w
+        OwpDxoTjUQlPlqGAGuzvWaPzSJndawgmMTr68oRsD+wlQmQQTR5eqxCpUIyV4aYb
+        D697RYzoqbT4mlU49ymzfKSAxFe88r1XQWdm81DcofHVPmw2GBrIqaX3Du4Z7xkI
+        Q9/S43orwknh5FoVwU8Nau7qBuv9vbw2apSkuA1oBj3spQ8hqwLavACyQ+fQloAT
+        hSDNqPiCZj6L0dwM1HYiqVoN3Q7qjgzzeBzlXzljJoWblhxllvMK20bVoa7H+uR2
+        lczFHfsX8VTIMjyTGP7R3oHN91DEahlQybVVNLmNSDKZM2P/0d28BRUmWxQJ4Ws3
+        J4hOWDKnLMed3VOIWzM=
+        =xVuW
+        -----END PGP PUBLIC KEY BLOCK-----
+      KEY
+    end
+
+    def secret_key
+      <<~KEY.strip
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+        lQPGBFnWcesBCAC6Y8FXl9ZJ9HPa6dIYcgQrvjIQcwoQCUEsaXNRpc+206RPCIXK
+        aIYr0nTD8GeovMuUONXTj+DdueQU2GAAqHHOqvDDVXqRrW3xfWnSwix7sTuhG1Ew
+        PLHYmjLENqaTsdyliEo3N8VWy2k0QRbC3R6xvop4Ooa87D5vcATIl0gYFtSiHIL+
+        TervYvTG9Eq1qSLZHbe2x4IzeqX2luikPKokL7j8FTZaCmC5MezIUur1ulfyYY/j
+        SkST/1aUFc5QXJJSZA0MYJWZX6x7Y3l7yl0dkHqmK8OTuo8RPWd3ybEiuvRsOL8K
+        GAv/PmVJRGDAf7GGbwXXsE9MiZ5GzVPxHnexABEBAAH+BwMC4UwgHgH5Cp7meY39
+        G5Q3GV2xtwADoaAvlOvPOLPK2fQqxQfb4WN4eZECp2wQuMRBMj52c4i9yphab1mQ
+        vOzoPIRGvkcJoxG++OxQ0kRk0C0gX6wM6SGVdb1nQnfZnoJCCU3IwCaSGktkLDs1
+        jwdI+VmXJbSugUbd25bakHQcE2BaNHuRBlQWQfFbhGBy0+uMfNDBZ6FRipBu47hO
+        f/wm/xXuV8N8BSgvNR/qtAqSQI34CdsnWAhMYm9rqmTNyt0nq4dveX+E0YzVn4lH
+        lOEa7cpYeuBwIL8L3EvSPNCICiJlF3gVqiYzyqRElnCkv1OGc0x3W5onY/agHgGZ
+        KYyi/ubOdqqDgBR+eMt0JKSGH2EPxUAGFPY5F37u4erdxH86GzIinAExLSmADiVR
+        KtxluZP6S2KLbETN5uVbrfa+HVcMbbUZaBHHtL+YbY8PqaFUIvIUR1HM2SK7IrFw
+        KuQ8ibRgooyP7VgMNiPzlFpY4NXUv+FXIrNJ6ELuIaENi0izJ7aIbVBM8SijDz6u
+        5EEmodnDvmU2hmQNZJ17TxggE7oeT0rKdDGHM5zBvqZ3deqE9sgKx/aTKcj61ID3
+        M80ZkHPDFazUCohLpYgFN20bYYSmxU4LeNFy8YEiuic8QQKaAFxSf9Lf87UFQwyF
+        dduI1RWEbjMsbEJXwlmGM02ssQHsgoVKwZxijq5A5R1Ul6LowazQ8obPiwRS4NZ4
+        Z+QKDon79MMXiFEeh1jeG/MKKWPxFg3pdtCWhC7WdH4hfkBsCVKf+T58yB2Gzziy
+        fOHvAl7v3PtdZgf1xikF8spGYGCWo4B2lxC79xIflKAb2U6myb5I4dpUYxzxoMxT
+        zxHwxEie3NxzZGUyXSt3LqYe2r4CxWnOCXWjIxxRlLue1BE5Za1ycnDRjgUO24+Z
+        uDQne6KLkhAotBtKb2huIERvZSA8am9obkBleGFtcGxlLmNvbT6JAU4EEwEIADgW
+        IQQIdIs2DNJcLsyZ1ZQHAWz54To/mwUCWdZx6wIbAwULCQgHAgYVCAkKCwIEFgID
+        AQIeAQIXgAAKCRAHAWz54To/m5MsB/4uMDsKQ8aE41EJT5ahgBrs71mj80iZ3WsI
+        JjE6+vKEbA/sJUJkEE0eXqsQqVCMleGmGw+ve0WM6Km0+JpVOPcps3ykgMRXvPK9
+        V0FnZvNQ3KHx1T5sNhgayKml9w7uGe8ZCEPf0uN6K8JJ4eRaFcFPDWru6gbr/b28
+        NmqUpLgNaAY97KUPIasC2rwAskPn0JaAE4Ugzaj4gmY+i9HcDNR2IqlaDd0O6o4M
+        83gc5V85YyaFm5YcZZbzCttG1aGux/rkdpXMxR37F/FUyDI8kxj+0d6BzfdQxGoZ
+        UMm1VTS5jUgymTNj/9HdvAUVJlsUCeFrNyeITlgypyzHnd1TiFsz
+        =/37z
+        -----END PGP PRIVATE KEY BLOCK-----
+      KEY
+    end
+
+    def primary_keyid
+      fingerprint[-16..-1]
+    end
+
+    def fingerprint
+      '08748B360CD25C2ECC99D59407016CF9E13A3F9B'
+    end
+  end
 end
-- 
cgit v1.2.1


From 7453b64347c7096b3e435c90e9e6a4eee4ab5638 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Fri, 6 Oct 2017 09:12:33 +0200
Subject: Resetting of active Line + setting it for the async display functions

---
 .../javascripts/repo/components/repo_preview.vue   |  8 +++++++-
 .../javascripts/repo/components/repo_sidebar.vue   | 22 ++++++++++++----------
 app/assets/javascripts/repo/stores/repo_store.js   |  5 +++--
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/app/assets/javascripts/repo/components/repo_preview.vue b/app/assets/javascripts/repo/components/repo_preview.vue
index 04732489c5f..9a9d200b8c6 100644
--- a/app/assets/javascripts/repo/components/repo_preview.vue
+++ b/app/assets/javascripts/repo/components/repo_preview.vue
@@ -14,6 +14,11 @@ export default {
     highlightFile() {
       $(this.$el).find('.file-content').syntaxHighlight();
     },
+    highlightLine() {
+      if (Store.activeLine > -1) {
+        this.lineHighlighter.highlightHash(`#L${Store.activeLine}`);
+      }
+    }
   },
   mounted() {
     this.highlightFile();
@@ -26,10 +31,11 @@ export default {
     html() {
       this.$nextTick(() => {
         this.highlightFile();
+        this.highlightLine();
       });
     },
     activeLine() {
-      this.lineHighlighter.highlightHash(`#L${Store.activeLine}`);
+      this.highlightLine();
     },
   },
 };
diff --git a/app/assets/javascripts/repo/components/repo_sidebar.vue b/app/assets/javascripts/repo/components/repo_sidebar.vue
index 99bf471b83d..10de23d0199 100644
--- a/app/assets/javascripts/repo/components/repo_sidebar.vue
+++ b/app/assets/javascripts/repo/components/repo_sidebar.vue
@@ -33,26 +33,25 @@ export default {
         // Maybe it is not in the current tree but in the opened tabs
         selectedFile = Helper.getFileFromPath(location.pathname);
       }
+
+      let lineNumber = null;
+      if (location.hash.indexOf('#L') > -1) lineNumber = Number(location.hash.substr(2));
+
       if (selectedFile) {
         if (selectedFile.url !== this.activeFile.url) {
-          this.fileClicked(selectedFile);
-        }
-
-        if (location.hash.indexOf('#L') > -1) {
-          const lineNumber = Number(location.hash.substr(2));
-          if (!isNaN(lineNumber)) {
-            Store.setActiveLine(lineNumber);
-          }
+          this.fileClicked(selectedFile, lineNumber);
+        } else {
+          Store.setActiveLine(lineNumber);
         }
       } else {
         // Not opened at all lets open new tab
         this.fileClicked({
           url: location.href,
-        });
+        }, lineNumber);
       }
     },
 
-    fileClicked(clickedFile) {
+    fileClicked(clickedFile, lineNumber) {
       let file = clickedFile;
       if (file.loading) return;
       file.loading = true;
@@ -60,17 +59,20 @@ export default {
       if (file.type === 'tree' && file.opened) {
         file = Store.removeChildFilesOfTree(file);
         file.loading = false;
+        Store.setActiveLine(lineNumber);
       } else {
         const openFile = Helper.getFileFromPath(file.url);
         if (openFile) {
           file.loading = false;
           Store.setActiveFiles(openFile);
+          Store.setActiveLine(lineNumber);
         } else {
           Service.url = file.url;
           Helper.getContent(file)
             .then(() => {
               file.loading = false;
               Helper.scrollTabsRight();
+              Store.setActiveLine(lineNumber);
             })
             .catch(Helper.loadingError);
         }
diff --git a/app/assets/javascripts/repo/stores/repo_store.js b/app/assets/javascripts/repo/stores/repo_store.js
index 0d1853ff148..93b39cff27e 100644
--- a/app/assets/javascripts/repo/stores/repo_store.js
+++ b/app/assets/javascripts/repo/stores/repo_store.js
@@ -26,7 +26,7 @@ const RepoStore = {
   },
   activeFile: Helper.getDefaultActiveFile(),
   activeFileIndex: 0,
-  activeLine: 0,
+  activeLine: -1,
   activeFileLabel: 'Raw',
   files: [],
   isCommitable: false,
@@ -85,6 +85,7 @@ const RepoStore = {
 
     if (!file.loading) Helper.updateHistoryEntry(file.url, file.pageTitle || file.name);
     RepoStore.binary = file.binary;
+    RepoStore.setActiveLine(-1);
   },
 
   setFileActivity(file, openedFile, i) {
@@ -102,7 +103,7 @@ const RepoStore = {
   },
 
   setActiveLine(activeLine) {
-    RepoStore.activeLine = activeLine;
+    if (!isNaN(activeLine)) RepoStore.activeLine = activeLine;
   },
 
   setActiveToRaw() {
-- 
cgit v1.2.1


From 97f964074741c54f153a45f6bdd5b9e303e6a306 Mon Sep 17 00:00:00 2001
From: Jarka Kadlecova <jarka@gitlab.com>
Date: Fri, 6 Oct 2017 08:56:28 +0200
Subject: Fix wording in the js messages

---
 app/assets/javascripts/sidebar/components/lock/edit_form.vue         | 2 +-
 app/assets/javascripts/vue_shared/components/issue/issue_warning.vue | 2 +-
 spec/javascripts/vue_shared/components/issue/issue_warning_spec.js   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/sidebar/components/lock/edit_form.vue b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
index 0fa19ef7217..c7a6edc7c70 100644
--- a/app/assets/javascripts/sidebar/components/lock/edit_form.vue
+++ b/app/assets/javascripts/sidebar/components/lock/edit_form.vue
@@ -48,7 +48,7 @@ export default {
         Lock this {{ issuableDisplayName(issuableType) }}?
         Only
         <strong>project members</strong>
-        will be able to comment
+        will be able to comment.
       </p>
 
       <edit-form-buttons
diff --git a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
index 7a8be8c42da..35d6f333417 100644
--- a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
+++ b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
@@ -39,7 +39,7 @@
 
     <span v-if="isLockedAndConfidential">
       {{ __('This issue is confidential and locked.') }}
-      {{ __('People without permission will never get a notification and not be able to comment.') }}
+      {{ __('People without permission will never get a notification and won\'t be able to comment.') }}
     </span>
 
     <span v-else-if="isConfidential">
diff --git a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
index a5f408d3165..6d8c6d17a1c 100644
--- a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
+++ b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
@@ -40,7 +40,7 @@ describe('Issue Warning Component', () => {
       });
 
       expect(vm.$el.querySelector('i')).toBeFalsy();
-      expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This issue is confidential and locked. People without permission will never get a notification and not be able to comment.');
+      expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This issue is confidential and locked. People without permission will never get a notification and won\'t be able to comment.');
     });
   });
 });
-- 
cgit v1.2.1


From ea023138bf5116a729e5accd5f81d4e586af6b02 Mon Sep 17 00:00:00 2001
From: Alessio Caiazza <acaiazza@gitlab.com>
Date: Fri, 6 Oct 2017 11:05:23 +0200
Subject: Repack migration correctly

---
 .../20170926102201_create_ci_build_trace_sections.rb  | 19 -------------------
 ...dd_build_foreign_key_to_ci_build_trace_sections.rb | 15 ---------------
 ...70929123651_create_ci_build_trace_section_names.rb | 19 -------------------
 ...add_name_foreign_key_to_ci_build_trace_sections.rb | 15 ---------------
 .../20171006090001_create_ci_build_trace_sections.rb  | 19 +++++++++++++++++++
 ...dd_build_foreign_key_to_ci_build_trace_sections.rb | 15 +++++++++++++++
 ...71006090100_create_ci_build_trace_section_names.rb | 19 +++++++++++++++++++
 ...add_name_foreign_key_to_ci_build_trace_sections.rb | 15 +++++++++++++++
 db/schema.rb                                          |  4 ++--
 9 files changed, 70 insertions(+), 70 deletions(-)
 delete mode 100644 db/migrate/20170926102201_create_ci_build_trace_sections.rb
 delete mode 100644 db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
 delete mode 100644 db/migrate/20170929123651_create_ci_build_trace_section_names.rb
 delete mode 100644 db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
 create mode 100644 db/migrate/20171006090001_create_ci_build_trace_sections.rb
 create mode 100644 db/migrate/20171006090010_add_build_foreign_key_to_ci_build_trace_sections.rb
 create mode 100644 db/migrate/20171006090100_create_ci_build_trace_section_names.rb
 create mode 100644 db/migrate/20171006091000_add_name_foreign_key_to_ci_build_trace_sections.rb

diff --git a/db/migrate/20170926102201_create_ci_build_trace_sections.rb b/db/migrate/20170926102201_create_ci_build_trace_sections.rb
deleted file mode 100644
index ad11b31b75d..00000000000
--- a/db/migrate/20170926102201_create_ci_build_trace_sections.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-class CreateCiBuildTraceSections < ActiveRecord::Migration
-  include Gitlab::Database::MigrationHelpers
-
-  DOWNTIME = false
-
-  def change
-    create_table :ci_build_trace_sections do |t|
-      t.datetime_with_timezone :date_start, null: false
-      t.datetime_with_timezone :date_end, null: false
-      t.integer :byte_start, limit: 8, null: false
-      t.integer :byte_end, limit: 8, null: false
-      t.references :project, null: false, index: true, foreign_key: { on_delete: :cascade }
-      t.integer :build_id, null: false
-      t.integer :section_name_id, null: false
-    end
-
-    add_index :ci_build_trace_sections, [:build_id, :section_name_id], unique: true
-  end
-end
diff --git a/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
deleted file mode 100644
index d279463eb4b..00000000000
--- a/db/migrate/20170926134436_add_build_foreign_key_to_ci_build_trace_sections.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-class AddBuildForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
-  include Gitlab::Database::MigrationHelpers
-
-  DOWNTIME = false
-
-  disable_ddl_transaction!
-
-  def up
-    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_builds, column: :build_id)
-  end
-
-  def down
-    remove_foreign_key(:ci_build_trace_sections, column: :build_id)
-  end
-end
diff --git a/db/migrate/20170929123651_create_ci_build_trace_section_names.rb b/db/migrate/20170929123651_create_ci_build_trace_section_names.rb
deleted file mode 100644
index 88f3e60699a..00000000000
--- a/db/migrate/20170929123651_create_ci_build_trace_section_names.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-class CreateCiBuildTraceSectionNames < ActiveRecord::Migration
-  include Gitlab::Database::MigrationHelpers
-
-  DOWNTIME = false
-
-  def up
-    create_table :ci_build_trace_section_names do |t|
-      t.references :project, null: false, foreign_key: { on_delete: :cascade }
-      t.string :name, null: false
-    end
-
-    add_index :ci_build_trace_section_names, [:project_id, :name], unique: true
-  end
-
-  def down
-    remove_foreign_key :ci_build_trace_section_names, column: :project_id
-    drop_table :ci_build_trace_section_names
-  end
-end
diff --git a/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
deleted file mode 100644
index 08422885a98..00000000000
--- a/db/migrate/20170929123915_add_name_foreign_key_to_ci_build_trace_sections.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-class AddNameForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
-  include Gitlab::Database::MigrationHelpers
-
-  DOWNTIME = false
-
-  disable_ddl_transaction!
-
-  def up
-    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_build_trace_section_names, column: :section_name_id)
-  end
-
-  def down
-    remove_foreign_key(:ci_build_trace_sections, column: :section_name_id)
-  end
-end
diff --git a/db/migrate/20171006090001_create_ci_build_trace_sections.rb b/db/migrate/20171006090001_create_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..ab5ef319618
--- /dev/null
+++ b/db/migrate/20171006090001_create_ci_build_trace_sections.rb
@@ -0,0 +1,19 @@
+class CreateCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    create_table :ci_build_trace_sections do |t|
+      t.references :project, null: false, index: true, foreign_key: { on_delete: :cascade }
+      t.datetime_with_timezone :date_start, null: false
+      t.datetime_with_timezone :date_end, null: false
+      t.integer :byte_start, limit: 8, null: false
+      t.integer :byte_end, limit: 8, null: false
+      t.integer :build_id, null: false
+      t.integer :section_name_id, null: false
+    end
+
+    add_index :ci_build_trace_sections, [:build_id, :section_name_id], unique: true
+  end
+end
diff --git a/db/migrate/20171006090010_add_build_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20171006090010_add_build_foreign_key_to_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..d279463eb4b
--- /dev/null
+++ b/db/migrate/20171006090010_add_build_foreign_key_to_ci_build_trace_sections.rb
@@ -0,0 +1,15 @@
+class AddBuildForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_builds, column: :build_id)
+  end
+
+  def down
+    remove_foreign_key(:ci_build_trace_sections, column: :build_id)
+  end
+end
diff --git a/db/migrate/20171006090100_create_ci_build_trace_section_names.rb b/db/migrate/20171006090100_create_ci_build_trace_section_names.rb
new file mode 100644
index 00000000000..88f3e60699a
--- /dev/null
+++ b/db/migrate/20171006090100_create_ci_build_trace_section_names.rb
@@ -0,0 +1,19 @@
+class CreateCiBuildTraceSectionNames < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def up
+    create_table :ci_build_trace_section_names do |t|
+      t.references :project, null: false, foreign_key: { on_delete: :cascade }
+      t.string :name, null: false
+    end
+
+    add_index :ci_build_trace_section_names, [:project_id, :name], unique: true
+  end
+
+  def down
+    remove_foreign_key :ci_build_trace_section_names, column: :project_id
+    drop_table :ci_build_trace_section_names
+  end
+end
diff --git a/db/migrate/20171006091000_add_name_foreign_key_to_ci_build_trace_sections.rb b/db/migrate/20171006091000_add_name_foreign_key_to_ci_build_trace_sections.rb
new file mode 100644
index 00000000000..08422885a98
--- /dev/null
+++ b/db/migrate/20171006091000_add_name_foreign_key_to_ci_build_trace_sections.rb
@@ -0,0 +1,15 @@
+class AddNameForeignKeyToCiBuildTraceSections < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key(:ci_build_trace_sections, :ci_build_trace_section_names, column: :section_name_id)
+  end
+
+  def down
+    remove_foreign_key(:ci_build_trace_sections, column: :section_name_id)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 4f2424ff2ab..5f16e14139c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20171004121444) do
+ActiveRecord::Schema.define(version: 20171006091000) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -215,11 +215,11 @@ ActiveRecord::Schema.define(version: 20171004121444) do
   add_index "ci_build_trace_section_names", ["project_id", "name"], name: "index_ci_build_trace_section_names_on_project_id_and_name", unique: true, using: :btree
 
   create_table "ci_build_trace_sections", force: :cascade do |t|
+    t.integer "project_id", null: false
     t.datetime_with_timezone "date_start", null: false
     t.datetime_with_timezone "date_end", null: false
     t.integer "byte_start", limit: 8, null: false
     t.integer "byte_end", limit: 8, null: false
-    t.integer "project_id", null: false
     t.integer "build_id", null: false
     t.integer "section_name_id", null: false
   end
-- 
cgit v1.2.1


From 5197e7c1a127767ec3b36eb5642489d9d4631827 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Fri, 6 Oct 2017 11:11:59 +0200
Subject: Good old dangling comma

---
 app/assets/javascripts/repo/components/repo_preview.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/repo/components/repo_preview.vue b/app/assets/javascripts/repo/components/repo_preview.vue
index 9a9d200b8c6..a87bef6084a 100644
--- a/app/assets/javascripts/repo/components/repo_preview.vue
+++ b/app/assets/javascripts/repo/components/repo_preview.vue
@@ -18,7 +18,7 @@ export default {
       if (Store.activeLine > -1) {
         this.lineHighlighter.highlightHash(`#L${Store.activeLine}`);
       }
-    }
+    },
   },
   mounted() {
     this.highlightFile();
-- 
cgit v1.2.1


From 638c616296b37b528c1b56f63a818301a502f7aa Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 18:23:53 +0900
Subject: Use utc for time comparision

---
 app/workers/wait_for_cluster_creation_worker.rb       |  2 +-
 lib/google_api/cloud_platform/client.rb               | 11 ++++++++---
 spec/lib/google_api/cloud_platform/client_spec.rb     |  4 ++--
 spec/workers/wait_for_cluster_creation_worker_spec.rb |  2 +-
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/app/workers/wait_for_cluster_creation_worker.rb b/app/workers/wait_for_cluster_creation_worker.rb
index eab340070e1..5aa3bbdaa9d 100644
--- a/app/workers/wait_for_cluster_creation_worker.rb
+++ b/app/workers/wait_for_cluster_creation_worker.rb
@@ -11,7 +11,7 @@ class WaitForClusterCreationWorker
       Ci::FetchGcpOperationService.new.execute(cluster) do |operation|
         case operation.status
         when 'RUNNING'
-          if TIMEOUT < Time.zone.now - operation.start_time.to_time
+          if TIMEOUT < Time.now.utc - operation.start_time.to_time.utc
             return cluster.make_errored!("Cluster creation time exceeds timeout; #{TIMEOUT}")
           end
 
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 926b7402cd5..5ec1fa37546 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -5,6 +5,7 @@ module GoogleApi
     class Client < GoogleApi::Auth
       DEFAULT_MACHINE_TYPE = 'n1-standard-1'.freeze
       SCOPE = 'https://www.googleapis.com/auth/cloud-platform'.freeze
+      LEAST_TOKEN_LIFE_TIME = 10.minutes
 
       class << self
         def session_key_for_token
@@ -25,9 +26,7 @@ module GoogleApi
         return false unless expires_at
 
         # Making sure that the token will have been still alive during the cluster creation.
-        unless DateTime.strptime(expires_at, '%s').to_time > Time.now + 10.minutes
-          return false
-        end
+        return false if token_life_time(expires_at) < LEAST_TOKEN_LIFE_TIME
 
         true
       end
@@ -68,6 +67,12 @@ module GoogleApi
         m = self_link.match(%r{projects/.*/zones/.*/operations/(.*)})
         m[1] if m
       end
+
+      private
+
+      def token_life_time(expires_at)
+        DateTime.strptime(expires_at, '%s').to_time.utc - Time.now.utc
+      end
     end
   end
 end
diff --git a/spec/lib/google_api/cloud_platform/client_spec.rb b/spec/lib/google_api/cloud_platform/client_spec.rb
index 6b454a593a0..6538dc21d6f 100644
--- a/spec/lib/google_api/cloud_platform/client_spec.rb
+++ b/spec/lib/google_api/cloud_platform/client_spec.rb
@@ -7,7 +7,7 @@ describe GoogleApi::CloudPlatform::Client do
   describe '#validate_token' do
     subject { client.validate_token(expires_at) }
 
-    let(:expires_at) { 1.hour.since.strftime('%s') }
+    let(:expires_at) { 1.hour.since.utc.strftime('%s') }
 
     context 'when token is nil' do
       let(:token) { nil }
@@ -26,7 +26,7 @@ describe GoogleApi::CloudPlatform::Client do
     end
 
     context 'when expires in 10 minutes' do
-      let(:expires_at) { 5.minutes.since.strftime('%s') }
+      let(:expires_at) { 5.minutes.since.utc.strftime('%s') }
 
       it { is_expected.to be_falsy }
     end
diff --git a/spec/workers/wait_for_cluster_creation_worker_spec.rb b/spec/workers/wait_for_cluster_creation_worker_spec.rb
index 6d82981287f..dcd4a3b9aec 100644
--- a/spec/workers/wait_for_cluster_creation_worker_spec.rb
+++ b/spec/workers/wait_for_cluster_creation_worker_spec.rb
@@ -24,7 +24,7 @@ describe WaitForClusterCreationWorker do
 
         context 'when operation timeout' do
           before do
-            allow(operation).to receive(:start_time).and_return(30.minutes.ago)
+            allow(operation).to receive(:start_time).and_return(30.minutes.ago.utc)
           end
 
           it 'sets an error message on cluster' do
-- 
cgit v1.2.1


From f71df9f536cc99f5e1626dae7dfe0ab15f7bd258 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Fri, 6 Oct 2017 10:45:28 +0100
Subject: Fix margins in edit form

---
 app/assets/stylesheets/pages/clusters.scss |  4 ++++
 app/views/projects/clusters/show.html.haml | 21 ++++++++++-----------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/app/assets/stylesheets/pages/clusters.scss b/app/assets/stylesheets/pages/clusters.scss
index 5c91579c69c..5538e46a6c4 100644
--- a/app/assets/stylesheets/pages/clusters.scss
+++ b/app/assets/stylesheets/pages/clusters.scss
@@ -2,4 +2,8 @@
   .clipboard-addon {
     background-color: $white-light;
   }
+
+  .alert-block {
+    margin-bottom: 20px;
+  }
 }
diff --git a/app/views/projects/clusters/show.html.haml b/app/views/projects/clusters/show.html.haml
index 651388ebde7..aee6f904a62 100644
--- a/app/views/projects/clusters/show.html.haml
+++ b/app/views/projects/clusters/show.html.haml
@@ -9,7 +9,7 @@
   .col-sm-4
     = render 'sidebar'
   .col-sm-8
-    %h4.prepend-top-0
+    %label.append-bottom-10{ for: 'enable-cluster-integration' }
       = s_('ClusterIntegration|Enable cluster integration')
     %p
       - if @cluster.enabled?
@@ -22,8 +22,8 @@
 
     = form_for [@project.namespace.becomes(Namespace), @project, @cluster] do |field|
       = form_errors(@cluster)
-      .form-group
-        %label.toggle-wrapper
+      .form-group.append-bottom-20
+        %label.append-bottom-10
           = field.hidden_field :enabled, { class: 'js-toggle-input'}
 
           %button{ type: 'button',
@@ -34,34 +34,33 @@
 
         - if can?(current_user, :update_cluster, @cluster)
           .form-group
-            = field.submit s_('ClusterIntegration|Save changes'), class: 'btn btn-success'
+            = field.submit s_('ClusterIntegration|Save'), class: 'btn btn-success'
 
     - if can?(current_user, :admin_cluster, @cluster)
-      %label
+      %label.append-bottom-10{ for: 'google-container-engine' }
         = s_('ClusterIntegration|Google Container Engine')
       %p
         - link_gke = link_to(s_('ClusterIntegration|Google Container Engine'), @cluster.gke_cluster_url, target: '_blank', rel: 'noopener noreferrer')
         = s_('ClusterIntegration|Manage your cluster by visiting %{link_gke}').html_safe % { link_gke: link_gke }
 
-      .hidden.js-cluster-error.alert.alert-danger{ role: 'alert' }
+      .hidden.js-cluster-error.alert.alert-danger.alert-block{ role: 'alert' }
         = s_('ClusterIntegration|Something went wrong while creating your cluster on Google Container Engine')
         %p.js-error-reason
 
-      .hidden.js-cluster-creating.alert.alert-info{ role: 'alert' }
+      .hidden.js-cluster-creating.alert.alert-info.alert-block{ role: 'alert' }
         = s_('ClusterIntegration|Cluster is being created on Google Container Engine...')
 
-      .hidden.js-cluster-success.alert.alert-info{ role: 'alert' }
+      .hidden.js-cluster-success.alert.alert-success.alert-block{ role: 'alert' }
         = s_('ClusterIntegration|Cluster was successfully created on Google Container Engine')
 
-    .form_group
-      %label{ for: 'cluter_name' }
+    .form_group.append-bottom-20
+      %label.append-bottom-10{ for: 'cluter-name' }
         = s_('ClusterIntegration|Cluster name')
       .input-group
         %input.form-control.cluster-name{ value: @cluster.gcp_cluster_name, disabled: true }
         %span.input-group-addon.clipboard-addon
           = clipboard_button(text: @cluster.gcp_cluster_name, title: s_('ClusterIntegration|Copy cluster name'))
 
-    %br
     - if can?(current_user, :admin_cluster, @cluster)
       .well.form_group
         %label.text-danger
-- 
cgit v1.2.1


From 3616e063e3dafc6eb4e627aa211e1030788b0be2 Mon Sep 17 00:00:00 2001
From: Phil Hughes <me@iamphill.com>
Date: Thu, 5 Oct 2017 15:57:49 +0100
Subject: Convert AbuseReports class to a module

---
 app/assets/javascripts/abuse_reports.js |  5 +--
 app/assets/javascripts/dispatcher.js    |  3 +-
 app/assets/javascripts/main.js          |  1 -
 spec/javascripts/abuse_reports_spec.js  | 80 ++++++++++++++++-----------------
 4 files changed, 42 insertions(+), 47 deletions(-)

diff --git a/app/assets/javascripts/abuse_reports.js b/app/assets/javascripts/abuse_reports.js
index 346de4ad11e..3de192d56eb 100644
--- a/app/assets/javascripts/abuse_reports.js
+++ b/app/assets/javascripts/abuse_reports.js
@@ -1,7 +1,7 @@
 const MAX_MESSAGE_LENGTH = 500;
 const MESSAGE_CELL_SELECTOR = '.abuse-reports .message';
 
-class AbuseReports {
+export default class AbuseReports {
   constructor() {
     $(MESSAGE_CELL_SELECTOR).each(this.truncateLongMessage);
     $(document)
@@ -32,6 +32,3 @@ class AbuseReports {
     }
   }
 }
-
-window.gl = window.gl || {};
-window.gl.AbuseReports = AbuseReports;
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index bbaa4e4d91e..eff8d4c8e6d 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -76,6 +76,7 @@ import initProjectVisibilitySelector from './project_visibility';
 import GpgBadges from './gpg_badges';
 import UserFeatureHelper from './helpers/user_feature_helper';
 import initChangesDropdown from './init_changes_dropdown';
+import AbuseReports from './abuse_reports';
 import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
 
 (function() {
@@ -557,7 +558,7 @@ import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
                   new Labels();
               }
             case 'abuse_reports':
-              new gl.AbuseReports();
+              new AbuseReports();
               break;
           }
           break;
diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 24abc5c5c9e..1d36beb8305 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -57,7 +57,6 @@ import './u2f/register';
 import './u2f/util';
 
 // everything else
-import './abuse_reports';
 import './activities';
 import './admin';
 import './ajax_loading_spinner';
diff --git a/spec/javascripts/abuse_reports_spec.js b/spec/javascripts/abuse_reports_spec.js
index 13cab81dd60..7f6b5873011 100644
--- a/spec/javascripts/abuse_reports_spec.js
+++ b/spec/javascripts/abuse_reports_spec.js
@@ -1,43 +1,41 @@
 import '~/lib/utils/text_utility';
-import '~/abuse_reports';
-
-((global) => {
-  describe('Abuse Reports', () => {
-    const FIXTURE = 'abuse_reports/abuse_reports_list.html.raw';
-    const MAX_MESSAGE_LENGTH = 500;
-
-    let $messages;
-
-    const assertMaxLength = $message => expect($message.text().length).toEqual(MAX_MESSAGE_LENGTH);
-    const findMessage = searchText => $messages.filter(
-      (index, element) => element.innerText.indexOf(searchText) > -1,
-    ).first();
-
-    preloadFixtures(FIXTURE);
-
-    beforeEach(function () {
-      loadFixtures(FIXTURE);
-      this.abuseReports = new global.AbuseReports();
-      $messages = $('.abuse-reports .message');
-    });
-
-    it('should truncate long messages', () => {
-      const $longMessage = findMessage('LONG MESSAGE');
-      expect($longMessage.data('original-message')).toEqual(jasmine.anything());
-      assertMaxLength($longMessage);
-    });
-
-    it('should not truncate short messages', () => {
-      const $shortMessage = findMessage('SHORT MESSAGE');
-      expect($shortMessage.data('original-message')).not.toEqual(jasmine.anything());
-    });
-
-    it('should allow clicking a truncated message to expand and collapse the full message', () => {
-      const $longMessage = findMessage('LONG MESSAGE');
-      $longMessage.click();
-      expect($longMessage.data('original-message').length).toEqual($longMessage.text().length);
-      $longMessage.click();
-      assertMaxLength($longMessage);
-    });
+import AbuseReports from '~/abuse_reports';
+
+describe('Abuse Reports', () => {
+  const FIXTURE = 'abuse_reports/abuse_reports_list.html.raw';
+  const MAX_MESSAGE_LENGTH = 500;
+
+  let $messages;
+
+  const assertMaxLength = $message => expect($message.text().length).toEqual(MAX_MESSAGE_LENGTH);
+  const findMessage = searchText => $messages.filter(
+    (index, element) => element.innerText.indexOf(searchText) > -1,
+  ).first();
+
+  preloadFixtures(FIXTURE);
+
+  beforeEach(function () {
+    loadFixtures(FIXTURE);
+    this.abuseReports = new AbuseReports();
+    $messages = $('.abuse-reports .message');
+  });
+
+  it('should truncate long messages', () => {
+    const $longMessage = findMessage('LONG MESSAGE');
+    expect($longMessage.data('original-message')).toEqual(jasmine.anything());
+    assertMaxLength($longMessage);
+  });
+
+  it('should not truncate short messages', () => {
+    const $shortMessage = findMessage('SHORT MESSAGE');
+    expect($shortMessage.data('original-message')).not.toEqual(jasmine.anything());
+  });
+
+  it('should allow clicking a truncated message to expand and collapse the full message', () => {
+    const $longMessage = findMessage('LONG MESSAGE');
+    $longMessage.click();
+    expect($longMessage.data('original-message').length).toEqual($longMessage.text().length);
+    $longMessage.click();
+    assertMaxLength($longMessage);
   });
-})(window.gl);
+});
-- 
cgit v1.2.1


From c0cfc9ebd26583c444f2cce1a23f939bfa7d8969 Mon Sep 17 00:00:00 2001
From: Alessio Caiazza <acaiazza@gitlab.com>
Date: Fri, 6 Oct 2017 12:33:10 +0200
Subject: Extract `Ci::Build#parse_trace_sections!` into a service

---
 app/models/ci/build.rb                             | 19 +-------
 .../extract_sections_from_build_trace_service.rb   | 30 ++++++++++++
 spec/models/ci/build_spec.rb                       | 23 +++------
 ...tract_sections_from_build_trace_service_spec.rb | 55 ++++++++++++++++++++++
 4 files changed, 92 insertions(+), 35 deletions(-)
 create mode 100644 app/services/ci/extract_sections_from_build_trace_service.rb
 create mode 100644 spec/services/ci/extract_sections_from_build_trace_service_spec.rb

diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 72e646210a8..6ca46ae89c1 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -267,24 +267,7 @@ module Ci
     end
 
     def parse_trace_sections!
-      return false unless trace_sections.empty?
-
-      sections = trace.extract_sections.map do |attr|
-        name = attr.delete(:name)
-        name_record = begin
-                        project.build_trace_section_names.find_or_create_by!(name: name)
-                      rescue ActiveRecord::RecordInvalid
-                        project.build_trace_section_names.find_by!(name: name)
-                      end
-
-        attr.merge(
-          build_id: self.id,
-          project_id: self.project_id,
-          section_name_id: name_record.id)
-      end
-
-      Gitlab::Database.bulk_insert(Ci::BuildTraceSection.table_name, sections)
-      true
+      ExtractSectionsFromBuildTraceService.new(project, user).execute(self)
     end
 
     def trace
diff --git a/app/services/ci/extract_sections_from_build_trace_service.rb b/app/services/ci/extract_sections_from_build_trace_service.rb
new file mode 100644
index 00000000000..75f9e0f897d
--- /dev/null
+++ b/app/services/ci/extract_sections_from_build_trace_service.rb
@@ -0,0 +1,30 @@
+module Ci
+  class ExtractSectionsFromBuildTraceService < BaseService
+    def execute(build)
+      return false unless build.trace_sections.empty?
+
+      Gitlab::Database.bulk_insert(BuildTraceSection.table_name, extract_sections(build))
+      true
+    end
+
+    private
+
+    def find_or_create_name(name)
+      project.build_trace_section_names.find_or_create_by!(name: name)
+    rescue ActiveRecord::RecordInvalid
+      project.build_trace_section_names.find_by!(name: name)
+    end
+
+    def extract_sections(build)
+      build.trace.extract_sections.map do |attr|
+        name = attr.delete(:name)
+        name_record = find_or_create_name(name)
+
+        attr.merge(
+          build_id: build.id,
+          project_id: project.id,
+          section_name_id: name_record.id)
+      end
+    end
+  end
+end
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 7fe12f92a2a..06f76b5501e 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -322,24 +322,13 @@ describe Ci::Build do
   end
 
   describe '#parse_trace_sections!' do
-    context "when the build trace has sections markers," do
-      before do
-        build.trace.set(File.read(expand_fixture_path('trace/trace_with_sections')))
-      end
-
-      it "saves the correct extracted sections" do
-        expect(build.trace_sections).to be_empty
-        expect(build.parse_trace_sections!).to be(true)
-        expect(build.trace_sections).not_to be_empty
-      end
-
-      it "fails if trace_sections isn't empty" do
-        expect(build.parse_trace_sections!).to be(true)
-        expect(build.trace_sections).not_to be_empty
+    it 'calls ExtractSectionsFromBuildTraceService' do
+      expect(Ci::ExtractSectionsFromBuildTraceService)
+          .to receive(:new).with(project, build.user).once.and_call_original
+      expect_any_instance_of(Ci::ExtractSectionsFromBuildTraceService)
+        .to receive(:execute).with(build).once
 
-        expect(build.parse_trace_sections!).to be(false)
-        expect(build.trace_sections).not_to be_empty
-      end
+      build.parse_trace_sections!
     end
   end
 
diff --git a/spec/services/ci/extract_sections_from_build_trace_service_spec.rb b/spec/services/ci/extract_sections_from_build_trace_service_spec.rb
new file mode 100644
index 00000000000..28f2fa7903a
--- /dev/null
+++ b/spec/services/ci/extract_sections_from_build_trace_service_spec.rb
@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe Ci::ExtractSectionsFromBuildTraceService, '#execute' do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+  let(:build) { create(:ci_build, project: project) }
+
+  subject { described_class.new(project, user) }
+
+  shared_examples 'build trace has sections markers' do
+    before do
+      build.trace.set(File.read(expand_fixture_path('trace/trace_with_sections')))
+    end
+
+    it 'saves the correct extracted sections' do
+      expect(build.trace_sections).to be_empty
+      expect(subject.execute(build)).to be(true)
+      expect(build.trace_sections).not_to be_empty
+    end
+
+    it "fails if trace_sections isn't empty" do
+      expect(subject.execute(build)).to be(true)
+      expect(build.trace_sections).not_to be_empty
+
+      expect(subject.execute(build)).to be(false)
+      expect(build.trace_sections).not_to be_empty
+    end
+  end
+
+  shared_examples 'build trace has no sections markers' do
+    before do
+      build.trace.set('no markerts')
+    end
+
+    it 'extracts no sections' do
+      expect(build.trace_sections).to be_empty
+      expect(subject.execute(build)).to be(true)
+      expect(build.trace_sections).to be_empty
+    end
+  end
+
+  context 'when the build has no user' do
+    it_behaves_like 'build trace has sections markers'
+    it_behaves_like 'build trace has no sections markers'
+  end
+
+  context 'when the build has a valid user' do
+    before do
+      build.user = user
+    end
+
+    it_behaves_like 'build trace has sections markers'
+    it_behaves_like 'build trace has no sections markers'
+  end
+end
-- 
cgit v1.2.1


From f4c10492f43f7d7a3790836d79680621faa38bd2 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Fri, 6 Oct 2017 12:16:08 +0100
Subject: Fix sidebar title Fix fixture

---
 app/views/layouts/nav/sidebar/_project.html.haml | 4 ++--
 spec/javascripts/fixtures/clusters.rb            | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/views/layouts/nav/sidebar/_project.html.haml b/app/views/layouts/nav/sidebar/_project.html.haml
index c750da4822a..759d6ff68ea 100644
--- a/app/views/layouts/nav/sidebar/_project.html.haml
+++ b/app/views/layouts/nav/sidebar/_project.html.haml
@@ -191,9 +191,9 @@
 
             - if project_nav_tab? :clusters
               = nav_link(controller: :clusters) do
-                = link_to project_clusters_path(@project), title: 'Clusters', class: 'shortcuts-clusters' do
+                = link_to project_clusters_path(@project), title: 'Cluster', class: 'shortcuts-cluster' do
                   %span
-                    Clusters
+                    Cluster
 
       - if project_nav_tab? :wiki
         = nav_link(controller: :wikis) do
diff --git a/spec/javascripts/fixtures/clusters.rb b/spec/javascripts/fixtures/clusters.rb
index bf8ba8146da..5774f36f026 100644
--- a/spec/javascripts/fixtures/clusters.rb
+++ b/spec/javascripts/fixtures/clusters.rb
@@ -11,7 +11,7 @@ describe Projects::ClustersController, '(JavaScript fixtures)', type: :controlle
   render_views
 
   before(:all) do
-    clean_frontend_fixtures('branches/')
+    clean_frontend_fixtures('clusters/')
   end
 
   before do
-- 
cgit v1.2.1


From 37e3d42b62bf2460f7443ac9e57661140983d335 Mon Sep 17 00:00:00 2001
From: "Luke \"Jared\" Bennett" <lbennett@gitlab.com>
Date: Fri, 6 Oct 2017 12:32:39 +0100
Subject: UX review

---
 app/assets/javascripts/vue_shared/components/issue/issue_warning.vue | 2 +-
 app/assets/stylesheets/framework/variables.scss                      | 1 +
 app/assets/stylesheets/pages/issuable.scss                           | 4 ++++
 app/assets/stylesheets/pages/note_form.scss                          | 4 ++++
 app/views/projects/_md_preview.html.haml                             | 2 +-
 5 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
index 35d6f333417..16c0a8efcd2 100644
--- a/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
+++ b/app/assets/javascripts/vue_shared/components/issue/issue_warning.vue
@@ -32,7 +32,7 @@
   <div class="issuable-note-warning">
     <i
       aria-hidden="true"
-      class="fa"
+      class="fa icon"
       :class="iconClass"
       v-if="!isLockedAndConfidential"
     ></i>
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index d7a8bfab08a..0dafe039028 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -703,3 +703,4 @@ $java: #70ad51;
 Issuable warning
 */
 $issuable-warning-size: 24px;
+$issuable-warning-icon-margin: 4px;
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index e8d57214cb7..db3b7e89d7b 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -14,6 +14,10 @@
   width: $issuable-warning-size;
   height: $issuable-warning-size;
   text-align: center;
+
+  &:first-of-type {
+    margin-right: $issuable-warning-icon-margin;
+  }
 }
 
 .sidebar-item-icon {
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index 14ce8b97c13..716bc4090cc 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -110,6 +110,10 @@
   padding: 3px 12px;
   margin: auto;
   align-items: center;
+
+  .icon {
+    margin-right: $issuable-warning-icon-margin;
+  }
 }
 
 .disabled-comment .issuable-note-warning {
diff --git a/app/views/projects/_md_preview.html.haml b/app/views/projects/_md_preview.html.haml
index 119a8279d89..770608eddff 100644
--- a/app/views/projects/_md_preview.html.haml
+++ b/app/views/projects/_md_preview.html.haml
@@ -2,7 +2,7 @@
 
 - if defined?(@merge_request) && @merge_request.discussion_locked?
   .issuable-note-warning
-    = icon('lock')
+    = icon('lock', class: 'icon')
     %span
       = _('This merge request is locked.')
       = _('Only project members can comment.')
-- 
cgit v1.2.1


From f293288589f24e1928b57dcd3428b762ae9ced79 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 21:28:40 +0900
Subject: Security fix: redirection in google_api/authorizations_controller

---
 .../google_api/authorizations_controller.rb        |  9 +++++++--
 app/controllers/projects/clusters_controller.rb    | 10 +++++++---
 lib/google_api/cloud_platform/client.rb            |  5 +++++
 .../google_api/authorizations_controller_spec.rb   | 23 ++++++++++++++--------
 spec/lib/google_api/cloud_platform/client_spec.rb  | 23 ++++++++++++++++++++++
 5 files changed, 57 insertions(+), 13 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index e4f76fb493e..709d1d34796 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -9,8 +9,13 @@ module GoogleApi
       session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] =
         expires_at.to_s
 
-      if params[:state].present?
-        redirect_to params[:state]
+      key, _ = GoogleApi::CloudPlatform::Client
+        .session_key_for_second_redirect_uri(secure: params[:state])
+
+      second_redirect_uri = session[key]
+
+      if second_redirect_uri.present?
+        redirect_to second_redirect_uri
       else
         redirect_to root_path
       end
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index ce8e73392b8..2f7364f4abf 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -16,9 +16,13 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def login
     begin
-      @authorize_url = GoogleApi::CloudPlatform::Client.new(
-        nil, callback_google_api_auth_url,
-        state: namespace_project_clusters_url.to_s).authorize_url
+      GoogleApi::CloudPlatform::Client.session_key_for_second_redirect_uri.tap do |key, secure|
+        session[key] = namespace_project_clusters_url.to_s
+
+        @authorize_url = GoogleApi::CloudPlatform::Client.new(
+          nil, callback_google_api_auth_url,
+          state: secure).authorize_url
+      end
     rescue GoogleApi::Auth::ConfigMissingError
       # no-op
     end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 5ec1fa37546..6d0c148b261 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -15,6 +15,11 @@ module GoogleApi
         def session_key_for_expires_at
           :cloud_platform_expires_at
         end
+
+        def session_key_for_second_redirect_uri(secure: nil)
+          secure = SecureRandom.hex unless secure
+          return "cloud_platform_second_redirect_uri_#{secure}", secure
+        end
       end
 
       def scope
diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
index 64c16af582f..5413f20c83c 100644
--- a/spec/controllers/google_api/authorizations_controller_spec.rb
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -3,12 +3,10 @@ require 'spec_helper'
 describe GoogleApi::AuthorizationsController do
   describe 'GET|POST #callback' do
     let(:user) { create(:user) }
-    let(:project) { create(:project) }
-    let(:state) { project_clusters_url(project).to_s }
     let(:token) { 'token' }
     let(:expires_at) { 1.hour.since.strftime('%s') }
 
-    subject { get :callback, code: 'xxx', state: state }
+    subject { get :callback, code: 'xxx', state: @state }
 
     before do
       sign_in(user)
@@ -17,7 +15,7 @@ describe GoogleApi::AuthorizationsController do
         .to receive(:get_token).and_return([token, expires_at])
     end
 
-    it 'sets token and expires_atin session' do
+    it 'sets token and expires_at in session' do
       subject
 
       expect(session[GoogleApi::CloudPlatform::Client.session_key_for_token])
@@ -26,15 +24,24 @@ describe GoogleApi::AuthorizationsController do
         .to eq(expires_at)
     end
 
-    context 'when redirection url is stored in state' do
+    context 'when second redirection url key is stored in state' do
+      set(:project) { create(:project) }
+      let(:second_redirect_uri) { namespace_project_clusters_url(project.namespace, project).to_s } # TODO: revrt
+
+      before do
+        GoogleApi::CloudPlatform::Client
+          .session_key_for_second_redirect_uri.tap do |key, secure|
+          @state = secure
+          session[key] = second_redirect_uri
+        end
+      end
+
       it 'redirects to the URL stored in state param' do
-        expect(subject).to redirect_to(state)
+        expect(subject).to redirect_to(second_redirect_uri)
       end
     end
 
     context 'when redirection url is not stored in state' do
-      let(:state) { '' }
-
       it 'redirects to root_path' do
         expect(subject).to redirect_to(root_path)
       end
diff --git a/spec/lib/google_api/cloud_platform/client_spec.rb b/spec/lib/google_api/cloud_platform/client_spec.rb
index 6538dc21d6f..e770f2e9edc 100644
--- a/spec/lib/google_api/cloud_platform/client_spec.rb
+++ b/spec/lib/google_api/cloud_platform/client_spec.rb
@@ -4,6 +4,29 @@ describe GoogleApi::CloudPlatform::Client do
   let(:token) { 'token' }
   let(:client) { described_class.new(token, nil) }
 
+  describe '.session_key_for_second_redirect_uri' do
+    subject { described_class.session_key_for_second_redirect_uri(secure: secure) }
+
+    context 'when pass a postfix' do
+      let(:secure) { SecureRandom.hex }
+
+      it 'creates a required session key' do
+        key, _ = described_class.session_key_for_second_redirect_uri(secure: secure)
+        expect(key).to eq("cloud_platform_second_redirect_uri_#{secure}")
+      end
+    end
+
+    context 'when pass a postfix' do
+      let(:secure) { nil }
+
+      it 'creates a new session key' do
+        key, secure = described_class.session_key_for_second_redirect_uri
+        expect(key).to include('cloud_platform_second_redirect_uri_')
+        expect(secure).not_to be_nil
+      end
+    end
+  end
+
   describe '#validate_token' do
     subject { client.validate_token(expires_at) }
 
-- 
cgit v1.2.1


From 8fc2331293fb750e3a978e8ccac147cadde70fcd Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 21:30:28 +0900
Subject: Change Clusters to Cluster in sidebar

---
 app/views/layouts/nav/sidebar/_project.html.haml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/layouts/nav/sidebar/_project.html.haml b/app/views/layouts/nav/sidebar/_project.html.haml
index c750da4822a..27ad0fdac1d 100644
--- a/app/views/layouts/nav/sidebar/_project.html.haml
+++ b/app/views/layouts/nav/sidebar/_project.html.haml
@@ -191,9 +191,9 @@
 
             - if project_nav_tab? :clusters
               = nav_link(controller: :clusters) do
-                = link_to project_clusters_path(@project), title: 'Clusters', class: 'shortcuts-clusters' do
+                = link_to project_clusters_path(@project), title: 'Cluster', class: 'shortcuts-clusters' do
                   %span
-                    Clusters
+                    Cluster
 
       - if project_nav_tab? :wiki
         = nav_link(controller: :wikis) do
-- 
cgit v1.2.1


From cd438a6ae00285e2cd32ea73a1cd769a5f9d7403 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 6 Oct 2017 21:37:50 +0900
Subject: Use short path project_clusters_url

---
 spec/controllers/google_api/authorizations_controller_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
index 5413f20c83c..253cfab64d1 100644
--- a/spec/controllers/google_api/authorizations_controller_spec.rb
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -26,7 +26,7 @@ describe GoogleApi::AuthorizationsController do
 
     context 'when second redirection url key is stored in state' do
       set(:project) { create(:project) }
-      let(:second_redirect_uri) { namespace_project_clusters_url(project.namespace, project).to_s } # TODO: revrt
+      let(:second_redirect_uri) { project_clusters_url(project).to_s }
 
       before do
         GoogleApi::CloudPlatform::Client
-- 
cgit v1.2.1


From ee2c13d78d2289c87218068c0231f1386d7da2eb Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Tue, 26 Sep 2017 13:42:04 +0200
Subject: Add 1000+ counters (instead of inifnite) to jobs controller

---
 app/helpers/numbers_helper.rb                                 | 11 +++++++++++
 app/views/projects/jobs/index.html.haml                       |  2 +-
 app/views/shared/builds/_tabs.html.haml                       |  8 ++++----
 .../unreleased/add-1000-plus-counters-for-jobs-page.yml       |  5 +++++
 4 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 app/helpers/numbers_helper.rb
 create mode 100644 changelogs/unreleased/add-1000-plus-counters-for-jobs-page.yml

diff --git a/app/helpers/numbers_helper.rb b/app/helpers/numbers_helper.rb
new file mode 100644
index 00000000000..45bd3606076
--- /dev/null
+++ b/app/helpers/numbers_helper.rb
@@ -0,0 +1,11 @@
+module NumbersHelper
+  def limited_counter_with_delimiter(resource, **options)
+    limit = options.fetch(:limit, 1000).to_i
+    count = resource.limit(limit + 1).count(:all)
+    if count > limit
+      number_with_delimiter(count - 1, options) + '+'
+    else
+      number_with_delimiter(count, options)
+    end
+  end
+end
diff --git a/app/views/projects/jobs/index.html.haml b/app/views/projects/jobs/index.html.haml
index 8604c7d3ea4..82b65844efc 100644
--- a/app/views/projects/jobs/index.html.haml
+++ b/app/views/projects/jobs/index.html.haml
@@ -9,7 +9,7 @@
 
     .nav-controls
       - if can?(current_user, :update_build, @project)
-        - if @all_builds.running_or_pending.any?
+        - if @all_builds.running_or_pending.limit(1).any?
           = link_to 'Cancel running', cancel_all_project_jobs_path(@project),
             data: { confirm: 'Are you sure?' }, class: 'btn btn-danger', method: :post
 
diff --git a/app/views/shared/builds/_tabs.html.haml b/app/views/shared/builds/_tabs.html.haml
index 3baa956b910..639f28cc210 100644
--- a/app/views/shared/builds/_tabs.html.haml
+++ b/app/views/shared/builds/_tabs.html.haml
@@ -3,22 +3,22 @@
     = link_to build_path_proc.call(nil) do
       All
       %span.badge.js-totalbuilds-count
-        = number_with_delimiter(all_builds.count(:id))
+        = limited_counter_with_delimiter(all_builds)
 
   %li{ class: active_when(scope == 'pending') }>
     = link_to build_path_proc.call('pending') do
       Pending
       %span.badge
-        = number_with_delimiter(all_builds.pending.count(:id))
+        = limited_counter_with_delimiter(all_builds.pending)
 
   %li{ class: active_when(scope == 'running') }>
     = link_to build_path_proc.call('running') do
       Running
       %span.badge
-        = number_with_delimiter(all_builds.running.count(:id))
+        = limited_counter_with_delimiter(all_builds.running)
 
   %li{ class: active_when(scope == 'finished') }>
     = link_to build_path_proc.call('finished') do
       Finished
       %span.badge
-        = number_with_delimiter(all_builds.finished.count(:id))
+        = limited_counter_with_delimiter(all_builds.finished)
diff --git a/changelogs/unreleased/add-1000-plus-counters-for-jobs-page.yml b/changelogs/unreleased/add-1000-plus-counters-for-jobs-page.yml
new file mode 100644
index 00000000000..5f5a61406da
--- /dev/null
+++ b/changelogs/unreleased/add-1000-plus-counters-for-jobs-page.yml
@@ -0,0 +1,5 @@
+---
+title: Add 1000+ counters to job page
+merge_request:
+author:
+type: fixed
-- 
cgit v1.2.1


From f9d490dbb910cdd05ca0a0fa38331708181e4b1e Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Fri, 6 Oct 2017 16:14:14 +0200
Subject: Improve redirect uri state and fix all remaining tests

---
 .../google_api/authorizations_controller.rb        | 17 +++++++++-----
 app/controllers/projects/clusters_controller.rb    | 16 ++++++++-----
 lib/google_api/cloud_platform/client.rb            | 11 ++++++---
 .../google_api/authorizations_controller_spec.rb   | 13 +++++------
 .../projects/clusters_controller_spec.rb           |  2 +-
 spec/features/projects/clusters_spec.rb            |  4 ++--
 spec/lib/google_api/cloud_platform/client_spec.rb  | 26 +++++++++-------------
 7 files changed, 48 insertions(+), 41 deletions(-)

diff --git a/app/controllers/google_api/authorizations_controller.rb b/app/controllers/google_api/authorizations_controller.rb
index 709d1d34796..5551057ff55 100644
--- a/app/controllers/google_api/authorizations_controller.rb
+++ b/app/controllers/google_api/authorizations_controller.rb
@@ -9,16 +9,21 @@ module GoogleApi
       session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] =
         expires_at.to_s
 
-      key, _ = GoogleApi::CloudPlatform::Client
-        .session_key_for_second_redirect_uri(secure: params[:state])
+      state_redirect_uri = redirect_uri_from_session_key(params[:state])
 
-      second_redirect_uri = session[key]
-
-      if second_redirect_uri.present?
-        redirect_to second_redirect_uri
+      if state_redirect_uri
+        redirect_to state_redirect_uri
       else
         redirect_to root_path
       end
     end
+
+    private
+
+    def redirect_uri_from_session_key(state)
+      key = GoogleApi::CloudPlatform::Client
+        .session_key_for_redirect_uri(params[:state])
+      session[key] if key
+    end
   end
 end
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 2f7364f4abf..03019b0becc 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -16,13 +16,11 @@ class Projects::ClustersController < Projects::ApplicationController
 
   def login
     begin
-      GoogleApi::CloudPlatform::Client.session_key_for_second_redirect_uri.tap do |key, secure|
-        session[key] = namespace_project_clusters_url.to_s
+      state = generate_session_key_redirect(namespace_project_clusters_url.to_s)
 
-        @authorize_url = GoogleApi::CloudPlatform::Client.new(
-          nil, callback_google_api_auth_url,
-          state: secure).authorize_url
-      end
+      @authorize_url = GoogleApi::CloudPlatform::Client.new(
+        nil, callback_google_api_auth_url,
+        state: state).authorize_url
     rescue GoogleApi::Auth::ConfigMissingError
       # no-op
     end
@@ -122,6 +120,12 @@ class Projects::ClustersController < Projects::ApplicationController
       session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at]
   end
 
+  def generate_session_key_redirect(uri)
+    GoogleApi::CloudPlatform::Client.new_session_key_for_redirect_uri do |key|
+      session[key] = uri
+    end
+  end
+
   def authorize_update_cluster!
     access_denied! unless can?(current_user, :update_cluster, cluster)
   end
diff --git a/lib/google_api/cloud_platform/client.rb b/lib/google_api/cloud_platform/client.rb
index 6d0c148b261..a440a3e3562 100644
--- a/lib/google_api/cloud_platform/client.rb
+++ b/lib/google_api/cloud_platform/client.rb
@@ -16,9 +16,14 @@ module GoogleApi
           :cloud_platform_expires_at
         end
 
-        def session_key_for_second_redirect_uri(secure: nil)
-          secure = SecureRandom.hex unless secure
-          return "cloud_platform_second_redirect_uri_#{secure}", secure
+        def new_session_key_for_redirect_uri
+          SecureRandom.hex.tap do |state|
+            yield session_key_for_redirect_uri(state)
+          end
+        end
+
+        def session_key_for_redirect_uri(state)
+          "cloud_platform_second_redirect_uri_#{state}"
         end
       end
 
diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
index 253cfab64d1..80d553f0f34 100644
--- a/spec/controllers/google_api/authorizations_controller_spec.rb
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -24,20 +24,19 @@ describe GoogleApi::AuthorizationsController do
         .to eq(expires_at)
     end
 
-    context 'when second redirection url key is stored in state' do
+    context 'when redirect uri key is stored in state' do
       set(:project) { create(:project) }
-      let(:second_redirect_uri) { project_clusters_url(project).to_s }
+      let(:redirect_uri) { project_clusters_url(project).to_s }
 
       before do
-        GoogleApi::CloudPlatform::Client
-          .session_key_for_second_redirect_uri.tap do |key, secure|
-          @state = secure
-          session[key] = second_redirect_uri
+        @state = GoogleApi::CloudPlatform::Client
+          .new_session_key_for_redirect_uri do |key|
+          session[key] = redirect_uri
         end
       end
 
       it 'redirects to the URL stored in state param' do
-        expect(subject).to redirect_to(second_redirect_uri)
+        expect(subject).to redirect_to(redirect_uri)
       end
     end
 
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
index b34702370e8..7985028d73b 100644
--- a/spec/controllers/projects/clusters_controller_spec.rb
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -190,7 +190,7 @@ describe Projects::ClustersController do
         subject
 
         expect(response).to have_http_status(:ok)
-        expect(response.body).to include("Save changes")
+        expect(response.body).to include("Save")
       end
 
       it "allows remove integration" do
diff --git a/spec/features/projects/clusters_spec.rb b/spec/features/projects/clusters_spec.rb
index 7f33629c938..810f2c39b43 100644
--- a/spec/features/projects/clusters_spec.rb
+++ b/spec/features/projects/clusters_spec.rb
@@ -69,14 +69,14 @@ feature 'Clusters', :js do
       end
 
       it 'user sees an cluster details page' do
-        expect(page).to have_button('Save changes')
+        expect(page).to have_button('Save')
         expect(page.find(:css, '.cluster-name').value).to eq(cluster.gcp_cluster_name)
       end
 
       context 'when user disables the cluster' do
         before do
           page.find(:css, '.js-toggle-cluster').click
-          click_button 'Save changes'
+          click_button 'Save'
         end
 
         it 'user sees the succeccful message' do
diff --git a/spec/lib/google_api/cloud_platform/client_spec.rb b/spec/lib/google_api/cloud_platform/client_spec.rb
index e770f2e9edc..acc5bd1da35 100644
--- a/spec/lib/google_api/cloud_platform/client_spec.rb
+++ b/spec/lib/google_api/cloud_platform/client_spec.rb
@@ -4,26 +4,20 @@ describe GoogleApi::CloudPlatform::Client do
   let(:token) { 'token' }
   let(:client) { described_class.new(token, nil) }
 
-  describe '.session_key_for_second_redirect_uri' do
-    subject { described_class.session_key_for_second_redirect_uri(secure: secure) }
+  describe '.session_key_for_redirect_uri' do
+    let(:state) { 'random_string' }
 
-    context 'when pass a postfix' do
-      let(:secure) { SecureRandom.hex }
+    subject { described_class.session_key_for_redirect_uri(state) }
 
-      it 'creates a required session key' do
-        key, _ = described_class.session_key_for_second_redirect_uri(secure: secure)
-        expect(key).to eq("cloud_platform_second_redirect_uri_#{secure}")
-      end
+    it 'creates a new session key' do
+      is_expected.to eq('cloud_platform_second_redirect_uri_random_string')
     end
+  end
 
-    context 'when pass a postfix' do
-      let(:secure) { nil }
-
-      it 'creates a new session key' do
-        key, secure = described_class.session_key_for_second_redirect_uri
-        expect(key).to include('cloud_platform_second_redirect_uri_')
-        expect(secure).not_to be_nil
-      end
+  describe '.new_session_key_for_redirect_uri' do
+    it 'generates a new session key' do
+      expect { |b| described_class.new_session_key_for_redirect_uri(&b) }
+        .to yield_with_args(String)
     end
   end
 
-- 
cgit v1.2.1


From 26f6065ec686d16a053e33f031779a8e75f0c5c9 Mon Sep 17 00:00:00 2001
From: Sean McGivern <sean@gitlab.com>
Date: Fri, 6 Oct 2017 16:30:11 +0100
Subject: Fix JS lock issue specs

---
 spec/javascripts/vue_shared/components/issue/issue_warning_spec.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
index 6d8c6d17a1c..2cf4d8e00ed 100644
--- a/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
+++ b/spec/javascripts/vue_shared/components/issue/issue_warning_spec.js
@@ -16,7 +16,7 @@ describe('Issue Warning Component', () => {
         isLocked: true,
       });
 
-      expect(vm.$el.querySelector('i').className).toEqual('fa fa-lock');
+      expect(vm.$el.querySelector('i').className).toEqual('fa icon fa-lock');
       expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This issue is locked. Only project members can comment.');
     });
   });
@@ -27,7 +27,7 @@ describe('Issue Warning Component', () => {
         isConfidential: true,
       });
 
-      expect(vm.$el.querySelector('i').className).toEqual('fa fa-eye-slash');
+      expect(vm.$el.querySelector('i').className).toEqual('fa icon fa-eye-slash');
       expect(formatWarning(vm.$el.querySelector('span').textContent)).toEqual('This is a confidential issue. Your comment will not be visible to the public.');
     });
   });
-- 
cgit v1.2.1


From 0885794008dda8528d0861a2afcdd12b56221b43 Mon Sep 17 00:00:00 2001
From: Dimitrie Hoekstra <dimitrie@gitlab.com>
Date: Fri, 6 Oct 2017 16:06:11 +0000
Subject: Adjust tooltips to adhere to 8px grid and make them more readable

---
 app/assets/stylesheets/framework.scss           | 1 +
 app/assets/stylesheets/framework/tooltips.scss  | 7 +++++++
 app/assets/stylesheets/framework/variables.scss | 5 +++++
 changelogs/unreleased/adjusting-tooltips.yml    | 5 +++++
 4 files changed, 18 insertions(+)
 create mode 100644 app/assets/stylesheets/framework/tooltips.scss
 create mode 100644 changelogs/unreleased/adjusting-tooltips.yml

diff --git a/app/assets/stylesheets/framework.scss b/app/assets/stylesheets/framework.scss
index 74b846217bb..e8037c77aab 100644
--- a/app/assets/stylesheets/framework.scss
+++ b/app/assets/stylesheets/framework.scss
@@ -40,6 +40,7 @@
 @import "framework/tables";
 @import "framework/notes";
 @import "framework/timeline";
+@import "framework/tooltips";
 @import "framework/typography";
 @import "framework/zen";
 @import "framework/blank";
diff --git a/app/assets/stylesheets/framework/tooltips.scss b/app/assets/stylesheets/framework/tooltips.scss
new file mode 100644
index 00000000000..93baf73cb78
--- /dev/null
+++ b/app/assets/stylesheets/framework/tooltips.scss
@@ -0,0 +1,7 @@
+.tooltip-inner {
+  font-size: $tooltip-font-size;
+  border-radius: $border-radius-default;
+  line-height: 16px;
+  font-weight: $gl-font-weight-normal;
+  padding: $gl-btn-padding;
+}
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 60260355765..e04790ab952 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -202,6 +202,11 @@ $md-area-border: #ddd;
 $code_font_size: 12px;
 $code_line_height: 1.6;
 
+/*
+ * Tooltips
+ */
+$tooltip-font-size: 12px;
+
 /*
  * Padding
  */
diff --git a/changelogs/unreleased/adjusting-tooltips.yml b/changelogs/unreleased/adjusting-tooltips.yml
new file mode 100644
index 00000000000..726b75caecd
--- /dev/null
+++ b/changelogs/unreleased/adjusting-tooltips.yml
@@ -0,0 +1,5 @@
+---
+title: Adjust tooltips to adhere to 8px grid and make them more readable
+merge_request:
+author:
+type: changed
-- 
cgit v1.2.1


From 68d992c0dd3a04d0035accd20d30769a7a989218 Mon Sep 17 00:00:00 2001
From: James Ramsay <jramsay@gitlab.com>
Date: Fri, 6 Oct 2017 12:16:42 -0400
Subject: Fix review comments

---
 doc/development/i18n/introduction.md | 8 ++++----
 doc/development/i18n/translation.md  | 5 ++---
 doc/development/i18n_guide.md        | 1 +
 3 files changed, 7 insertions(+), 7 deletions(-)
 create mode 100644 doc/development/i18n_guide.md

diff --git a/doc/development/i18n/introduction.md b/doc/development/i18n/introduction.md
index a54b09359ce..e8182ace9c3 100644
--- a/doc/development/i18n/introduction.md
+++ b/doc/development/i18n/introduction.md
@@ -1,6 +1,6 @@
 # Translate GitLab to your language
 
-The text in GitLab's user interface is in English by default.
+The text in GitLab's user interface is in American English by default.
 Each string can be translated to other languages.
 As each string is translated, it is added to the languages translation file,
 and will be available in future releases of GitLab.
@@ -17,9 +17,9 @@ Translating strings will help complete and improve each language.
 
 Before a string can be translated, it must be externalized.
 This is the process where English strings in the GitLab source code are wrapped in a function that
-retrieves the translated string for the users language.
+retrieves the translated string for the user's language.
 
-As new features are added and existing features are updated the surrounding strings are being
+As new features are added and existing features are updated, the surrounding strings are being
 externalized, however, there are many parts of GitLab that still need more work to externalize all
 strings.
 
@@ -67,7 +67,7 @@ Requests to become a proof reader will be considered on the merits of previous t
 - Spanish
 - Ukrainian
 
-If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues) and add the `internationalization` label.
+If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
 
 ### Release
 
diff --git a/doc/development/i18n/translation.md b/doc/development/i18n/translation.md
index cc61eef2e87..8687e47ee1c 100644
--- a/doc/development/i18n/translation.md
+++ b/doc/development/i18n/translation.md
@@ -16,7 +16,7 @@ GitLab is being translated into many languages.
 
 1. Select the language you would like to contribute translations to by clicking the flag
 1. You will see a list of files and folders.
-  Click `gitlab.pot` top open the translation editor.
+  Click `gitlab.pot` to open the translation editor.
 
 ### Translation Editor
 
@@ -31,7 +31,7 @@ The online translation editor is the easiest way to contribute translations.
   If the string to be translated is not clear, you can 'Request Context'
 
 A glossary of common terms is available in the right panel by clicking Terms.
-Comments can be added to discuss a translation with the community
+Comments can be added to discuss a translation with the community.
 
 Remember to **Save** each translation.
 
@@ -58,4 +58,3 @@ suitable level of formality.
 
 To propose additions to the glossary please
 [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
-
diff --git a/doc/development/i18n_guide.md b/doc/development/i18n_guide.md
new file mode 100644
index 00000000000..a95142312af
--- /dev/null
+++ b/doc/development/i18n_guide.md
@@ -0,0 +1 @@
+This document was moved to [development/i18n/externalization.md](i18n/externalization.md).
-- 
cgit v1.2.1


From fed755bf851b9de83acc75c7d63e47190579a7f4 Mon Sep 17 00:00:00 2001
From: William Chia <wchia@gitlab.com>
Date: Fri, 6 Oct 2017 16:27:40 +0000
Subject: Add delete issue docs

---
 doc/user/permissions.md                      |   1 +
 doc/user/project/issues/deleting_issues.md   |  11 +++++++++++
 doc/user/project/issues/img/delete_issue.png | Bin 0 -> 49894 bytes
 doc/user/project/issues/index.md             |   4 ++++
 4 files changed, 16 insertions(+)
 create mode 100644 doc/user/project/issues/deleting_issues.md
 create mode 100644 doc/user/project/issues/img/delete_issue.png

diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 44ee994a26b..8ff7b483c2a 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -71,6 +71,7 @@ The following table depicts the various user permission levels in a project.
 | Switch visibility level               |         |            |             |          | ✓      |
 | Transfer project to another namespace |         |            |             |          | ✓      |
 | Remove project                        |         |            |             |          | ✓      |
+| Delete issues                         |         |            |             |          | ✓      |
 | Force push to protected branches [^4] |         |            |             |          |        |
 | Remove protected branches [^4]        |         |            |             |          |        |
 | Remove pages                          |         |            |             |          | ✓      |
diff --git a/doc/user/project/issues/deleting_issues.md b/doc/user/project/issues/deleting_issues.md
new file mode 100644
index 00000000000..d7442104c53
--- /dev/null
+++ b/doc/user/project/issues/deleting_issues.md
@@ -0,0 +1,11 @@
+# Deleting Issues
+
+> [Introduced][ce-2982] in GitLab 8.6
+
+Please read through the [GitLab Issue Documentation](index.md) for an overview on GitLab Issues.
+
+You can delete an issue by editing it and clicking on the delete button. 
+
+![delete issue - button](img/delete_issue.png)
+
+>**Note:** Only [project owners](../../permissions.md) can delete issues. 
\ No newline at end of file
diff --git a/doc/user/project/issues/img/delete_issue.png b/doc/user/project/issues/img/delete_issue.png
new file mode 100644
index 00000000000..a356f52044e
Binary files /dev/null and b/doc/user/project/issues/img/delete_issue.png differ
diff --git a/doc/user/project/issues/index.md b/doc/user/project/issues/index.md
index 0f187946a4a..3e81dcb78c6 100644
--- a/doc/user/project/issues/index.md
+++ b/doc/user/project/issues/index.md
@@ -90,6 +90,10 @@ Learn distinct ways to [close issues](closing_issues.md) in GitLab.
 
 Read through the [documentation on moving issues](moving_issues.md).
 
+## Deleting issues
+
+Read through the [documentation on deleting issues](deleting_issues.md)
+
 ## Create a merge request from an issue
 
 Learn more about it on the [GitLab Issues Functionalities documentation](issues_functionalities.md#18-new-merge-request).
-- 
cgit v1.2.1


From 2c5148b388a2838cbeaaf9a2fea4dd460a975764 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 6 Oct 2017 09:51:29 -0700
Subject: Improve pgloader documentation

[ci skip]
---
 doc/update/mysql_to_postgresql.md | 162 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 158 insertions(+), 4 deletions(-)

diff --git a/doc/update/mysql_to_postgresql.md b/doc/update/mysql_to_postgresql.md
index a3eba38c91a..fff47180099 100644
--- a/doc/update/mysql_to_postgresql.md
+++ b/doc/update/mysql_to_postgresql.md
@@ -44,11 +44,11 @@ Here's what you'll need to have installed:
     sudo gitlab-ctl reconfigure
     ```
 
-1. Start Unicorn and PostgreSQL so that we could prepare the schema:
+1. Start Unicorn and PostgreSQL so that we can prepare the schema:
 
     ``` bash
     sudo gitlab-ctl start unicorn
-    sudo gitlab-ctl start posgresql
+    sudo gitlab-ctl start postgresql
     ```
 
 1. Run the following commands to prepare the schema:
@@ -57,7 +57,7 @@ Here's what you'll need to have installed:
     sudo gitlab-rake db:create db:migrate
     ```
 
-1. Stop Unicorn in case it's interfering the next step:
+1. Stop Unicorn to prevent other database access from interfering with the loading of data:
 
     ``` bash
     sudo gitlab-ctl stop unicorn
@@ -92,7 +92,147 @@ Now, you can use pgloader to migrate the data from MySQL to PostgreSQL:
     sudo -u gitlab-psql pgloader commands.load
     ```
 
-1. Once the migration finishes, start GitLab:
+1. Once the migration finishes, you should see a summary table that looks like
+the following:
+
+
+    ```
+                                     table name       read   imported     errors      total time
+    -----------------------------------------------  ---------  ---------  ---------  --------------
+                                    fetch meta data        119        119          0          0.388s
+                                           Truncate        119        119          0          1.134s
+    -----------------------------------------------  ---------  ---------  ---------  --------------
+                               public.abuse_reports          0          0          0          0.490s
+                                 public.appearances          0          0          0          0.488s
+                                   public.approvals          0          0          0          0.273s
+                        public.application_settings          1          1          0          0.266s
+                                   public.approvers          0          0          0          0.339s
+                             public.approver_groups          0          0          0          0.357s
+                                public.audit_events          1          1          0          0.410s
+                                 public.award_emoji          0          0          0          0.441s
+                                      public.boards          0          0          0          0.505s
+                          public.broadcast_messages          0          0          0          0.498s
+                                  public.chat_names          0          0          0          0.576s
+                                  public.chat_teams          0          0          0          0.617s
+                                   public.ci_builds          0          0          0          0.611s
+                          public.ci_group_variables          0          0          0          0.620s
+                                public.ci_pipelines          0          0          0          0.599s
+                       public.ci_pipeline_schedules          0          0          0          0.622s
+              public.ci_pipeline_schedule_variables          0          0          0          0.573s
+                       public.ci_pipeline_variables          0          0          0          0.594s
+                                  public.ci_runners          0          0          0          0.533s
+                          public.ci_runner_projects          0          0          0          0.584s
+                        public.ci_sources_pipelines          0          0          0          0.564s
+                                   public.ci_stages          0          0          0          0.595s
+                                 public.ci_triggers          0          0          0          0.569s
+                         public.ci_trigger_requests          0          0          0          0.596s
+                                public.ci_variables          0          0          0          0.565s
+                      public.container_repositories          0          0          0          0.605s
+    public.conversational_development_index_metrics          0          0          0          0.571s
+                                 public.deployments          0          0          0          0.607s
+                                      public.emails          0          0          0          0.602s
+                        public.deploy_keys_projects          0          0          0          0.557s
+                                      public.events        160        160          0          0.677s
+                                public.environments          0          0          0          0.567s
+                                    public.features          0          0          0          0.639s
+                        public.events_for_migration        160        160          0          0.582s
+                               public.feature_gates          0          0          0          0.579s
+                        public.forked_project_links          0          0          0          0.660s
+                                   public.geo_nodes          0          0          0          0.686s
+                               public.geo_event_log          0          0          0          0.626s
+             public.geo_repositories_changed_events          0          0          0          0.677s
+                    public.geo_node_namespace_links          0          0          0          0.618s
+               public.geo_repository_renamed_events          0          0          0          0.696s
+                                    public.gpg_keys          0          0          0          0.704s
+               public.geo_repository_deleted_events          0          0          0          0.638s
+                             public.historical_data          0          0          0          0.729s
+               public.geo_repository_updated_events          0          0          0          0.634s
+                              public.index_statuses          0          0          0          0.746s
+                              public.gpg_signatures          0          0          0          0.667s
+                             public.issue_assignees         80         80          0          0.769s
+                                  public.identities          0          0          0          0.655s
+                               public.issue_metrics         80         80          0          0.781s
+                                      public.issues         80         80          0          0.720s
+                                      public.labels          0          0          0          0.795s
+                                 public.issue_links          0          0          0          0.707s
+                            public.label_priorities          0          0          0          0.793s
+                                        public.keys          0          0          0          0.734s
+                                 public.lfs_objects          0          0          0          0.812s
+                                 public.label_links          0          0          0          0.725s
+                                    public.licenses          0          0          0          0.813s
+                            public.ldap_group_links          0          0          0          0.751s
+                                     public.members         52         52          0          0.830s
+                        public.lfs_objects_projects          0          0          0          0.738s
+               public.merge_requests_closing_issues          0          0          0          0.825s
+                                       public.lists          0          0          0          0.769s
+                  public.merge_request_diff_commits          0          0          0          0.840s
+                       public.merge_request_metrics          0          0          0          0.837s
+                              public.merge_requests          0          0          0          0.753s
+                         public.merge_request_diffs          0          0          0          0.771s
+                                  public.namespaces         30         30          0          0.874s
+                    public.merge_request_diff_files          0          0          0          0.775s
+                                       public.notes          0          0          0          0.849s
+                                  public.milestones         40         40          0          0.799s
+                         public.oauth_access_grants          0          0          0          0.979s
+                        public.namespace_statistics          0          0          0          0.797s
+                          public.oauth_applications          0          0          0          0.899s
+                       public.notification_settings         72         72          0          0.818s
+                         public.oauth_access_tokens          0          0          0          0.807s
+                               public.pages_domains          0          0          0          0.958s
+                       public.oauth_openid_requests          0          0          0          0.832s
+                      public.personal_access_tokens          0          0          0          0.965s
+                                    public.projects          8          8          0          0.987s
+                                  public.path_locks          0          0          0          0.925s
+                                       public.plans          0          0          0          0.923s
+                            public.project_features          8          8          0          0.985s
+                      public.project_authorizations         66         66          0          0.969s
+                         public.project_import_data          8          8          0          1.002s
+                          public.project_statistics          8          8          0          1.001s
+                         public.project_group_links          0          0          0          0.949s
+                         public.project_mirror_data          0          0          0          0.972s
+        public.protected_branch_merge_access_levels          0          0          0          1.017s
+                          public.protected_branches          0          0          0          0.969s
+         public.protected_branch_push_access_levels          0          0          0          0.991s
+                              public.protected_tags          0          0          0          1.009s
+          public.protected_tag_create_access_levels          0          0          0          0.985s
+                         public.push_event_payloads          0          0          0          1.041s
+                                  public.push_rules          0          0          0          0.999s
+                             public.redirect_routes          0          0          0          1.020s
+                              public.remote_mirrors          0          0          0          1.034s
+                                    public.releases          0          0          0          0.993s
+                           public.schema_migrations        896        896          0          1.057s
+                                      public.routes         38         38          0          1.021s
+                                    public.services          0          0          0          1.055s
+                          public.sent_notifications          0          0          0          1.003s
+                          public.slack_integrations          0          0          0          1.022s
+                                   public.spam_logs          0          0          0          1.024s
+                                    public.snippets          0          0          0          1.058s
+                               public.subscriptions          0          0          0          1.069s
+                                    public.taggings          0          0          0          1.099s
+                                    public.timelogs          0          0          0          1.104s
+                        public.system_note_metadata          0          0          0          1.038s
+                                        public.tags          0          0          0          1.034s
+                           public.trending_projects          0          0          0          1.140s
+                                     public.uploads          0          0          0          1.129s
+                                       public.todos         80         80          0          1.085s
+                         public.users_star_projects          0          0          0          1.153s
+                           public.u2f_registrations          0          0          0          1.061s
+                                   public.web_hooks          0          0          0          1.179s
+                                       public.users         26         26          0          1.163s
+                          public.user_agent_details          0          0          0          1.068s
+                               public.web_hook_logs          0          0          0          1.080s
+    -----------------------------------------------  ---------  ---------  ---------  --------------
+                            COPY Threads Completion          4          4          0          2.008s
+                                    Reset Sequences        113        113          0          0.304s
+                                   Install Comments          0          0          0          0.000s
+    -----------------------------------------------  ---------  ---------  ---------  --------------
+                                  Total import time       1894       1894          0         12.497s
+    ```
+
+    If there is no output for more than 30 minutes, it's possible pgloader encountered an error. See
+    the [troubleshooting guide](#Troubleshooting) for more details.
+
+1. Start GitLab:
 
     ``` bash
     sudo gitlab-ctl start
@@ -102,6 +242,20 @@ Now, you can verify that everything worked by visiting GitLab.
 
 ## Troubleshooting
 
+### Permissions
+
+Note that the PostgreSQL user that you use for the above MUST have **superuser** privileges. Otherwise, you may see
+a similar message to the following:
+
+```
+debugger invoked on a CL-POSTGRES-ERROR:INSUFFICIENT-PRIVILEGE in thread
+    #<THREAD "lparallel" RUNNING {10078A3513}>:
+      Database error 42501: permission denied: "RI_ConstraintTrigger_a_20937" is a system trigger
+    QUERY: ALTER TABLE ci_builds DISABLE TRIGGER ALL;
+    2017-08-23T00:36:56.782000Z ERROR Database error 42501: permission denied: "RI_ConstraintTrigger_c_20864" is a system trigger
+    QUERY: ALTER TABLE approver_groups DISABLE TRIGGER ALL;
+```
+
 ### Experiencing 500 errors after the migration
 
 If you experience 500 errors after the migration, try to clear the cache:
-- 
cgit v1.2.1


From 60e9ba21e9cec68629d39a554747607f3049fd88 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Fri, 6 Oct 2017 18:12:42 +0100
Subject: Removes unnecessary load of LinkedTabs, Pipelines and
 MiniPipelineGraph classes

---
 app/assets/javascripts/main.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 24abc5c5c9e..2c1dcc374ff 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -40,7 +40,6 @@ import './commit/file';
 import './commit/image_file';
 
 // lib/utils
-import './lib/utils/bootstrap_linked_tabs';
 import { handleLocationHash } from './lib/utils/common_utils';
 import './lib/utils/datetime_utility';
 import './lib/utils/pretty_time';
@@ -111,7 +110,6 @@ import './merge_request';
 import './merge_request_tabs';
 import './milestone';
 import './milestone_select';
-import './mini_pipeline_graph_dropdown';
 import './namespace_select';
 import './new_branch_form';
 import './new_commit_form';
@@ -119,7 +117,6 @@ import './notes';
 import './notifications_dropdown';
 import './notifications_form';
 import './pager';
-import './pipelines';
 import './preview_markdown';
 import './project';
 import './project_avatar';
-- 
cgit v1.2.1


From 1ba3c747f3453d9411a63c287aeaf86d2419f8fa Mon Sep 17 00:00:00 2001
From: Andrew Newdigate <andrew@gitlab.com>
Date: Fri, 6 Oct 2017 17:16:20 +0000
Subject: Gitaly feature flag metadata

---
 .../unreleased/gitaly_feature_flag_metadata.yml     |  5 +++++
 lib/gitlab/gitaly_client.rb                         | 21 +++++++++++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/unreleased/gitaly_feature_flag_metadata.yml

diff --git a/changelogs/unreleased/gitaly_feature_flag_metadata.yml b/changelogs/unreleased/gitaly_feature_flag_metadata.yml
new file mode 100644
index 00000000000..58e42ef9324
--- /dev/null
+++ b/changelogs/unreleased/gitaly_feature_flag_metadata.yml
@@ -0,0 +1,5 @@
+---
+title: Add client and call site metadata to Gitaly calls for better traceability
+merge_request: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14332
+author:
+type: added
diff --git a/lib/gitlab/gitaly_client.rb b/lib/gitlab/gitaly_client.rb
index 87b300dcf7e..cf36106e23d 100644
--- a/lib/gitlab/gitaly_client.rb
+++ b/lib/gitlab/gitaly_client.rb
@@ -28,6 +28,7 @@ module Gitlab
 
     SERVER_VERSION_FILE = 'GITALY_SERVER_VERSION'.freeze
     MAXIMUM_GITALY_CALLS = 30
+    CLIENT_NAME = (Sidekiq.server? ? 'gitlab-sidekiq' : 'gitlab-web').freeze
 
     MUTEX = Mutex.new
     private_constant :MUTEX
@@ -79,7 +80,16 @@ module Gitlab
 
     def self.request_metadata(storage)
       encoded_token = Base64.strict_encode64(token(storage).to_s)
-      { metadata: { 'authorization' => "Bearer #{encoded_token}" } }
+      metadata = {
+        'authorization' => "Bearer #{encoded_token}",
+        'client_name' => CLIENT_NAME
+      }
+
+      feature_stack = Thread.current[:gitaly_feature_stack]
+      feature = feature_stack && feature_stack[0]
+      metadata['call_site'] = feature.to_s if feature
+
+      { metadata: metadata }
     end
 
     def self.token(storage)
@@ -137,7 +147,14 @@ module Gitlab
       Gitlab::Metrics.measure(metric_name) do
         # Some migrate calls wrap other migrate calls
         allow_n_plus_1_calls do
-          yield is_enabled
+          feature_stack = Thread.current[:gitaly_feature_stack] ||= []
+          feature_stack.unshift(feature)
+          begin
+            yield is_enabled
+          ensure
+            feature_stack.shift
+            Thread.current[:gitaly_feature_stack] = nil if feature_stack.empty?
+          end
         end
       end
     end
-- 
cgit v1.2.1


From cf62c96adcfc82764c831ce90a7752e44263c601 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Fri, 6 Oct 2017 19:57:42 +0200
Subject: Ensure we set SUITE_FLAKY_RSPEC_REPORT_PATH to nil in
 RspecFlaky::Listener spec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémy Coutable <remy@rymai.me>
---
 spec/lib/rspec_flaky/listener_spec.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/spec/lib/rspec_flaky/listener_spec.rb b/spec/lib/rspec_flaky/listener_spec.rb
index 7590ea9576d..bfb7648b486 100644
--- a/spec/lib/rspec_flaky/listener_spec.rb
+++ b/spec/lib/rspec_flaky/listener_spec.rb
@@ -45,6 +45,7 @@ describe RspecFlaky::Listener, :aggregate_failures do
     # Stub these env variables otherwise specs don't behave the same on the CI
     stub_env('CI_PROJECT_URL', nil)
     stub_env('CI_JOB_ID', nil)
+    stub_env('SUITE_FLAKY_RSPEC_REPORT_PATH', nil)
   end
 
   describe '#initialize' do
-- 
cgit v1.2.1


From 2ae20000a3c1a51a05c6048393ce2031a15ab6a8 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Thu, 28 Sep 2017 15:54:16 -0700
Subject: Remove nav images; remove old nav styles; create new file for other
 navigation elements

---
 app/assets/images/new_nav.png                      | Bin 14322 -> 0 bytes
 app/assets/images/old_nav.png                      | Bin 25617 -> 0 bytes
 app/assets/stylesheets/framework.scss              |   1 +
 app/assets/stylesheets/framework/blocks.scss       |   4 +
 app/assets/stylesheets/framework/layout.scss       |   4 -
 app/assets/stylesheets/framework/nav.scss          | 515 ---------------------
 app/assets/stylesheets/framework/new-nav.scss      |   5 -
 .../framework/secondary-navigation-elements.scss   | 337 ++++++++++++++
 app/assets/stylesheets/pages/boards.scss           |   1 -
 app/views/users/show.html.haml                     |   2 +-
 10 files changed, 343 insertions(+), 526 deletions(-)
 delete mode 100644 app/assets/images/new_nav.png
 delete mode 100644 app/assets/images/old_nav.png
 create mode 100644 app/assets/stylesheets/framework/secondary-navigation-elements.scss

diff --git a/app/assets/images/new_nav.png b/app/assets/images/new_nav.png
deleted file mode 100644
index f98ca15d787..00000000000
Binary files a/app/assets/images/new_nav.png and /dev/null differ
diff --git a/app/assets/images/old_nav.png b/app/assets/images/old_nav.png
deleted file mode 100644
index 23fae7aa19e..00000000000
Binary files a/app/assets/images/old_nav.png and /dev/null differ
diff --git a/app/assets/stylesheets/framework.scss b/app/assets/stylesheets/framework.scss
index e8037c77aab..09a29d41823 100644
--- a/app/assets/stylesheets/framework.scss
+++ b/app/assets/stylesheets/framework.scss
@@ -34,6 +34,7 @@
 @import "framework/new-nav";
 @import "framework/pagination";
 @import "framework/panels";
+@import "framework/secondary-navigation-elements";
 @import "framework/selects";
 @import "framework/sidebar";
 @import "framework/new-sidebar";
diff --git a/app/assets/stylesheets/framework/blocks.scss b/app/assets/stylesheets/framework/blocks.scss
index 1d72a70f0f5..d63145771c9 100644
--- a/app/assets/stylesheets/framework/blocks.scss
+++ b/app/assets/stylesheets/framework/blocks.scss
@@ -207,6 +207,10 @@
 
   &.user-cover-block {
     padding: 24px 0 0;
+
+    .nav-links {
+      justify-content: center;
+    }
   }
 
   .group-info {
diff --git a/app/assets/stylesheets/framework/layout.scss b/app/assets/stylesheets/framework/layout.scss
index bd521028c44..69d19ea2962 100644
--- a/app/assets/stylesheets/framework/layout.scss
+++ b/app/assets/stylesheets/framework/layout.scss
@@ -25,10 +25,6 @@ body {
 
 .content-wrapper {
   padding-bottom: 100px;
-
-  &:not(.page-with-layout-nav) {
-    margin-top: $header-height;
-  }
 }
 
 .container {
diff --git a/app/assets/stylesheets/framework/nav.scss b/app/assets/stylesheets/framework/nav.scss
index f8777d1fd9d..ca206ce818f 100644
--- a/app/assets/stylesheets/framework/nav.scss
+++ b/app/assets/stylesheets/framework/nav.scss
@@ -1,255 +1,3 @@
-
-
-.nav-links {
-  display: flex;
-  padding: 0;
-  margin: 0;
-  list-style: none;
-  height: auto;
-  border-bottom: 1px solid $border-color;
-
-  li {
-    display: flex;
-
-    a {
-      padding: $gl-btn-padding;
-      padding-bottom: 11px;
-      font-size: 14px;
-      line-height: 28px;
-      color: $gl-text-color-secondary;
-      border-bottom: 2px solid transparent;
-      white-space: nowrap;
-
-      &:hover,
-      &:active,
-      &:focus {
-        text-decoration: none;
-        border-bottom: 2px solid $gray-darkest;
-        color: $black;
-
-        .badge {
-          color: $black;
-        }
-      }
-    }
-
-    &.active a {
-      border-bottom: 2px solid $link-underline-blue;
-      color: $black;
-      font-weight: $gl-font-weight-bold;
-
-      .badge {
-        color: $black;
-      }
-    }
-  }
-
-  &.sub-nav {
-    text-align: center;
-    background-color: $gray-normal;
-
-    .container-fluid {
-      background-color: $gray-normal;
-      margin-bottom: 0;
-      display: flex;
-    }
-
-    li {
-      &.active a {
-        border-bottom: none;
-        color: $link-underline-blue;
-      }
-
-      a {
-        margin: 0;
-        padding: 11px 10px 9px;
-
-        &:hover,
-        &:active,
-        &:focus {
-          border-color: transparent;
-        }
-      }
-    }
-  }
-}
-
-.top-area {
-  @include clearfix;
-  border-bottom: 1px solid $border-color;
-
-  .nav-text {
-    padding-top: 16px;
-    padding-bottom: 11px;
-    display: inline-block;
-    line-height: 28px;
-    white-space: normal;
-
-    /* Small devices (phones, tablets, 768px and lower) */
-    @media (max-width: $screen-xs-max) {
-      width: 100%;
-    }
-  }
-
-  .nav-search {
-    display: inline-block;
-    width: 100%;
-    padding: 11px 0;
-
-    /* Small devices (phones, tablets, 768px and lower) */
-    @media (min-width: $screen-sm-min) {
-      width: 50%;
-    }
-  }
-
-  .nav-links {
-    margin-bottom: 0;
-    border-bottom: none;
-    float: left;
-
-    &.wide {
-      width: 100%;
-      display: block;
-    }
-
-    &.scrolling-tabs {
-      float: left;
-    }
-
-    li a {
-      padding: 16px 15px 11px;
-    }
-
-    /* Small devices (phones, tablets, 768px and lower) */
-    @media (max-width: $screen-xs-max) {
-      width: 100%;
-    }
-  }
-
-  .nav-controls {
-    @include new-style-dropdown;
-
-    display: inline-block;
-    float: right;
-    text-align: right;
-    padding: 11px 0;
-    margin-bottom: 0;
-
-    > .btn,
-    > .btn-container,
-    > .dropdown,
-    > input,
-    > form {
-      margin-right: $gl-padding-top;
-      display: inline-block;
-      vertical-align: top;
-
-      &:last-child {
-        margin-right: 0;
-        float: right;
-      }
-    }
-
-    &.nav-controls-new-nav {
-      > .dropdown {
-        margin-right: 0;
-      }
-    }
-
-    > .btn-grouped {
-      float: none;
-    }
-
-    .icon-label {
-      display: none;
-    }
-
-    input {
-      display: inline-block;
-      position: relative;
-
-      /* Medium devices (desktops, 992px and up) */
-      @media (min-width: $screen-md-min) { width: 200px; }
-
-      /* Large devices (large desktops, 1200px and up) */
-      @media (min-width: $screen-lg-min) { width: 250px; }
-
-      &.input-short {
-        /* Medium devices (desktops, 992px and up) */
-        @media (min-width: $screen-md-min) { width: 170px; }
-
-        /* Large devices (large desktops, 1200px and up) */
-        @media (min-width: $screen-lg-min) { width: 210px; }
-      }
-    }
-
-    @media (max-width: $screen-xs-max) {
-      padding-bottom: 0;
-      width: 100%;
-
-      .btn,
-      form,
-      .dropdown,
-      .dropdown-toggle,
-      .dropdown-menu-toggle,
-      .form-control {
-        margin: 0 0 10px;
-        display: block;
-        width: 100%;
-      }
-
-      form {
-        display: block;
-        height: auto;
-        margin-bottom: 14px;
-
-        input {
-          width: 100%;
-          margin: 0 0 10px;
-        }
-      }
-
-      .input-short {
-        width: 100%;
-      }
-
-      .icon-label {
-        display: inline-block;
-      }
-
-      // Applies on /dashboard/issues
-      .project-item-select-holder {
-        margin: 0;
-      }
-    }
-  }
-
-  &.adjust {
-    .nav-text,
-    .nav-controls {
-      width: auto;
-
-      @media (max-width: $screen-xs-max) {
-        width: 100%;
-      }
-    }
-  }
-
-  &.multi-line {
-    .nav-text {
-      line-height: 20px;
-    }
-
-    .nav-controls {
-      padding: 17px 0;
-    }
-  }
-
-  pre {
-    width: 100%;
-  }
-}
-
 .project-item-select-holder.btn-group {
   display: flex;
   max-width: 350px;
@@ -280,272 +28,9 @@
     @media(max-width: $screen-xs-max) {
       max-width: 250px;
     }
-
   }
 }
 
 .new-project-item-select-button .fa-caret-down {
   margin-left: 2px;
 }
-
-.layout-nav {
-  width: 100%;
-  background: $gray-light;
-  border-bottom: 1px solid $border-color;
-  transition: padding $sidebar-transition-duration;
-  text-align: center;
-  margin-top: $new-navbar-height;
-
-  .container-fluid {
-    position: relative;
-
-    .nav-control {
-      @media (max-width: $screen-sm-max) {
-        margin-right: 2px;
-      }
-    }
-  }
-
-  .controls {
-    float: right;
-    padding: 7px 0 0;
-
-    i {
-      color: $layout-link-gray;
-    }
-
-    .fa-rss,
-    .fa-cog {
-      font-size: 16px;
-    }
-
-    .fa-caret-down {
-      margin-left: 5px;
-      color: $gl-text-color-secondary;
-    }
-
-    .dropdown {
-      position: absolute;
-      top: 7px;
-      right: 15px;
-      z-index: 300;
-
-      li.active {
-        font-weight: $gl-font-weight-bold;
-      }
-    }
-  }
-
-  .nav-links {
-    border-bottom: none;
-    height: 51px;
-
-    @media (min-width: $screen-sm-min) {
-      justify-content: center;
-    }
-
-    li {
-      a {
-        padding-top: 10px;
-      }
-    }
-  }
-}
-
-.with-performance-bar .layout-nav {
-  margin-top: $header-height + $performance-bar-height;
-}
-
-.scrolling-tabs-container {
-  position: relative;
-
-  .merge-request-tabs-container & {
-    overflow: hidden;
-  }
-
-  .nav-links {
-    @include scrolling-links();
-  }
-
-  .fade-right {
-    @include fade(left, $gray-light);
-    right: -5px;
-
-    .fa {
-      right: -7px;
-    }
-  }
-
-  .fade-left {
-    @include fade(right, $gray-light);
-    left: -5px;
-    text-align: center;
-
-    .fa {
-      left: -7px;
-    }
-  }
-
-  &.sub-nav-scroll {
-
-    .fade-right {
-      @include fade(left, $gray-normal);
-      right: 0;
-
-      .fa {
-        right: -23px;
-      }
-    }
-
-    .fade-left {
-      @include fade(right, $gray-normal);
-      left: 0;
-
-      .fa {
-        left: 10px;
-      }
-    }
-  }
-}
-
-.nav-block {
-  position: relative;
-
-  .nav-links {
-    @include scrolling-links();
-
-    .fade-right {
-      @include fade(left, $white-light);
-      right: -5px;
-
-      .fa {
-        right: -7px;
-      }
-    }
-
-    .fade-left {
-      @include fade(right, $white-light);
-      left: -5px;
-
-      .fa {
-        left: -7px;
-      }
-    }
-  }
-}
-
-.page-with-layout-nav {
-  .right-sidebar {
-    top: ($header-height + 1) * 2;
-  }
-
-  &.page-with-sub-nav {
-    .right-sidebar {
-      top: ($header-height + 1) * 3;
-
-      &.affix {
-        top: $header-height;
-      }
-    }
-  }
-}
-
-.with-performance-bar .page-with-layout-nav {
-  .right-sidebar {
-    top: ($header-height + 1) * 2 + $performance-bar-height;
-  }
-
-  &.page-with-sub-nav {
-    .right-sidebar {
-      top: ($header-height + 1) * 3 + $performance-bar-height;
-
-      &.affix {
-        top: $header-height + $performance-bar-height;
-      }
-    }
-  }
-}
-
-.nav-block {
-  &.activities {
-    border-bottom: 1px solid $border-color;
-
-    .nav-links {
-      border-bottom: none;
-    }
-  }
-}
-
-@media (max-width: $screen-xs-max) {
-  .top-area {
-    flex-flow: row wrap;
-
-    .nav-controls {
-      $controls-margin: $btn-xs-side-margin - 2px;
-      flex: 0 0 100%;
-
-      &.controls-flex {
-        display: flex;
-        flex-flow: row wrap;
-        align-items: center;
-        justify-content: center;
-        padding: 0 0 $gl-padding-top;
-      }
-
-      .controls-item,
-      .controls-item-full,
-      .controls-item:last-child {
-        flex: 1 1 35%;
-        display: block;
-        width: 100%;
-        margin: $controls-margin;
-
-        .btn,
-        .dropdown {
-          margin: 0;
-        }
-      }
-
-      .controls-item-full {
-        flex: 1 1 100%;
-      }
-    }
-  }
-}
-
-.inner-page-scroll-tabs {
-  position: relative;
-
-  .fade-right {
-    @include fade(left, $white-light);
-    right: 0;
-    text-align: right;
-
-    .fa {
-      right: 5px;
-    }
-  }
-
-  .fade-left {
-    @include fade(right, $white-light);
-    left: 0;
-    text-align: left;
-
-    .fa {
-      left: 5px;
-    }
-  }
-
-  .fade-right,
-  .fade-left {
-    top: 16px;
-    bottom: auto;
-  }
-
-  &.is-smaller {
-    .fade-right,
-    .fade-left {
-      top: 11px;
-    }
-  }
-}
diff --git a/app/assets/stylesheets/framework/new-nav.scss b/app/assets/stylesheets/framework/new-nav.scss
index 7899be2c2d3..3663ebf3039 100644
--- a/app/assets/stylesheets/framework/new-nav.scss
+++ b/app/assets/stylesheets/framework/new-nav.scss
@@ -1,8 +1,3 @@
-@import "framework/variables";
-@import 'framework/tw_bootstrap_variables';
-@import "bootstrap/variables";
-@import "framework/mixins";
-
 .content-wrapper.page-with-new-nav {
   margin-top: $new-navbar-height;
 }
diff --git a/app/assets/stylesheets/framework/secondary-navigation-elements.scss b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
new file mode 100644
index 00000000000..1b9a26512b4
--- /dev/null
+++ b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
@@ -0,0 +1,337 @@
+// For tabbed navigation links, scrolling tabs, etc. For all top/main navigation,
+// please check nav.scss
+.nav-links {
+  display: flex;
+  padding: 0;
+  margin: 0;
+  list-style: none;
+  height: auto;
+
+  li {
+    display: flex;
+
+    a {
+      font-size: 14px;
+      line-height: 28px;
+      color: $gl-text-color-secondary;
+      border-bottom: 2px solid transparent;
+      white-space: nowrap;
+
+      &:hover,
+      &:active,
+      &:focus {
+        text-decoration: none;
+        color: $black;
+
+        .badge {
+          color: $black;
+        }
+      }
+    }
+
+    &.active a {
+      color: $black;
+      font-weight: $gl-font-weight-bold;
+
+      .badge {
+        color: $black;
+      }
+    }
+  }
+}
+
+.top-area {
+  @include clearfix;
+  border-bottom: 1px solid $border-color;
+
+  .nav-text {
+    padding-top: 16px;
+    padding-bottom: 11px;
+    display: inline-block;
+    line-height: 28px;
+    white-space: normal;
+
+    /* Small devices (phones, tablets, 768px and lower) */
+    @media (max-width: $screen-xs-max) {
+      width: 100%;
+    }
+  }
+
+  .nav-links {
+    margin-bottom: 0;
+    border-bottom: none;
+    float: left;
+
+    &.wide {
+      width: 100%;
+      display: block;
+    }
+
+    &.scrolling-tabs {
+      float: left;
+    }
+
+    li a {
+      padding: 16px 15px 11px;
+    }
+
+    /* Small devices (phones, tablets, 768px and lower) */
+    @media (max-width: $screen-xs-max) {
+      width: 100%;
+    }
+  }
+
+  .nav-controls {
+    @include new-style-dropdown;
+
+    display: inline-block;
+    float: right;
+    text-align: right;
+    padding: 11px 0;
+    margin-bottom: 0;
+
+    > .btn,
+    > .btn-container,
+    > .dropdown,
+    > input,
+    > form {
+      margin-right: $gl-padding-top;
+      display: inline-block;
+      vertical-align: top;
+
+      &:last-child {
+        margin-right: 0;
+        float: right;
+      }
+    }
+
+    > .btn-grouped {
+      float: none;
+    }
+
+    .icon-label {
+      display: none;
+    }
+
+    input {
+      display: inline-block;
+      position: relative;
+
+      /* Medium devices (desktops, 992px and up) */
+      @media (min-width: $screen-md-min) { width: 200px; }
+
+      /* Large devices (large desktops, 1200px and up) */
+      @media (min-width: $screen-lg-min) { width: 250px; }
+
+      &.input-short {
+        /* Medium devices (desktops, 992px and up) */
+        @media (min-width: $screen-md-min) { width: 170px; }
+
+        /* Large devices (large desktops, 1200px and up) */
+        @media (min-width: $screen-lg-min) { width: 210px; }
+      }
+    }
+
+    @media (max-width: $screen-xs-max) {
+      padding-bottom: 0;
+      width: 100%;
+
+      .btn,
+      form,
+      .dropdown,
+      .dropdown-toggle,
+      .dropdown-menu-toggle,
+      .form-control {
+        margin: 0 0 10px;
+        display: block;
+        width: 100%;
+      }
+
+      form {
+        display: block;
+        height: auto;
+        margin-bottom: 14px;
+
+        input {
+          width: 100%;
+          margin: 0 0 10px;
+        }
+      }
+
+      .input-short {
+        width: 100%;
+      }
+
+      .icon-label {
+        display: inline-block;
+      }
+
+      // Applies on /dashboard/issues
+      .project-item-select-holder {
+        margin: 0;
+      }
+    }
+  }
+
+  &.adjust {
+    .nav-text,
+    .nav-controls {
+      width: auto;
+
+      @media (max-width: $screen-xs-max) {
+        width: 100%;
+      }
+    }
+  }
+
+  &.multi-line {
+    .nav-text {
+      line-height: 20px;
+    }
+
+    .nav-controls {
+      padding: 17px 0;
+    }
+  }
+
+  pre {
+    width: 100%;
+  }
+
+  @media (max-width: $screen-xs-max) {
+    flex-flow: row wrap;
+
+    .nav-controls {
+      $controls-margin: $btn-xs-side-margin - 2px;
+      flex: 0 0 100%;
+
+      &.controls-flex {
+        display: flex;
+        flex-flow: row wrap;
+        align-items: center;
+        justify-content: center;
+        padding: 0 0 $gl-padding-top;
+      }
+
+      .controls-item,
+      .controls-item-full,
+      .controls-item:last-child {
+        flex: 1 1 35%;
+        display: block;
+        width: 100%;
+        margin: $controls-margin;
+
+        .btn,
+        .dropdown {
+          margin: 0;
+        }
+      }
+
+      .controls-item-full {
+        flex: 1 1 100%;
+      }
+    }
+  }
+}
+
+.scrolling-tabs-container {
+  position: relative;
+
+  .merge-request-tabs-container & {
+    overflow: hidden;
+  }
+
+  .nav-links {
+    @include scrolling-links();
+  }
+
+  .fade-right {
+    @include fade(left, $gray-light);
+    right: -5px;
+
+    .fa {
+      right: -7px;
+    }
+  }
+
+  .fade-left {
+    @include fade(right, $gray-light);
+    left: -5px;
+    text-align: center;
+
+    .fa {
+      left: -7px;
+    }
+  }
+}
+
+.inner-page-scroll-tabs {
+  position: relative;
+
+  .fade-right {
+    @include fade(left, $white-light);
+    right: 0;
+    text-align: right;
+
+    .fa {
+      right: 5px;
+    }
+  }
+
+  .fade-left {
+    @include fade(right, $white-light);
+    left: 0;
+    text-align: left;
+
+    .fa {
+      left: 5px;
+    }
+  }
+
+  .fade-right,
+  .fade-left {
+    top: 16px;
+    bottom: auto;
+  }
+
+  &.is-smaller {
+    .fade-right,
+    .fade-left {
+      top: 11px;
+    }
+  }
+}
+
+.nav-block {
+  position: relative;
+
+  .nav-links {
+    @include scrolling-links();
+
+    .fade-right {
+      @include fade(left, $white-light);
+      right: -5px;
+
+      .fa {
+        right: -7px;
+      }
+    }
+
+    .fade-left {
+      @include fade(right, $white-light);
+      left: -5px;
+
+      .fa {
+        left: -7px;
+      }
+    }
+  }
+
+  &.activities {
+    border-bottom: 1px solid $border-color;
+
+    .nav-links {
+      border-bottom: none;
+    }
+  }
+}
diff --git a/app/assets/stylesheets/pages/boards.scss b/app/assets/stylesheets/pages/boards.scss
index 3305a482a0d..ca61f7a30c3 100644
--- a/app/assets/stylesheets/pages/boards.scss
+++ b/app/assets/stylesheets/pages/boards.scss
@@ -414,7 +414,6 @@
   margin: 5px;
 }
 
-.page-with-layout-nav.page-with-sub-nav .issue-boards-sidebar,
 .page-with-new-sidebar.page-with-sidebar .issue-boards-sidebar {
   .issuable-sidebar-header {
     position: relative;
diff --git a/app/views/users/show.html.haml b/app/views/users/show.html.haml
index d0ffcc88d43..6c3cd6ecefe 100644
--- a/app/views/users/show.html.haml
+++ b/app/views/users/show.html.haml
@@ -9,7 +9,7 @@
   = auto_discovery_link_tag(:atom, user_url(@user, format: :atom), title: "#{@user.name} activity")
 
 .user-profile
-  .cover-block.user-cover-block.layout-nav
+  .cover-block.user-cover-block.top-area
     .cover-controls
       - if @user == current_user
         = link_to profile_path, class: 'btn btn-gray has-tooltip', title: 'Edit profile', 'aria-label': 'Edit profile' do
-- 
cgit v1.2.1


From af86b5dec1ac8ea7120cc5eb51320bf21eea761a Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Thu, 28 Sep 2017 16:17:04 -0700
Subject: Fix scrolling tabs

---
 app/assets/stylesheets/framework/blocks.scss                        | 6 ++++++
 app/assets/stylesheets/framework/secondary-navigation-elements.scss | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/app/assets/stylesheets/framework/blocks.scss b/app/assets/stylesheets/framework/blocks.scss
index d63145771c9..dbd990f84c1 100644
--- a/app/assets/stylesheets/framework/blocks.scss
+++ b/app/assets/stylesheets/framework/blocks.scss
@@ -210,6 +210,12 @@
 
     .nav-links {
       justify-content: center;
+      width: 100%;
+      float: none;
+
+      &.scrolling-tabs {
+        float: none;
+      }
     }
   }
 
diff --git a/app/assets/stylesheets/framework/secondary-navigation-elements.scss b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
index 1b9a26512b4..5be6bae3368 100644
--- a/app/assets/stylesheets/framework/secondary-navigation-elements.scss
+++ b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
@@ -11,6 +11,8 @@
     display: flex;
 
     a {
+      padding: $gl-btn-padding;
+      padding-bottom: 11px;
       font-size: 14px;
       line-height: 28px;
       color: $gl-text-color-secondary;
-- 
cgit v1.2.1


From 314cfc39a7c3832f212d9837970f6cc59c436a50 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Thu, 28 Sep 2017 16:51:29 -0700
Subject: Fixes

---
 app/assets/stylesheets/framework/header.scss       | 94 ----------------------
 app/assets/stylesheets/framework/nav.scss          | 35 --------
 app/assets/stylesheets/framework/new-nav.scss      | 92 +++++++++++++++++++++
 .../framework/secondary-navigation-elements.scss   | 37 +++++++++
 app/assets/stylesheets/pages/search.scss           |  1 +
 5 files changed, 130 insertions(+), 129 deletions(-)

diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index d932ea8794f..63eed636476 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -6,8 +6,6 @@
 header {
   @include new-style-dropdown;
 
-  transition: padding $sidebar-transition-duration;
-
   &.navbar-empty {
     height: $header-height;
     background: $white-light;
@@ -313,95 +311,3 @@ header {
     color: $red-500;
   }
 }
-
-.with-performance-bar header.navbar-gitlab {
-  top: $performance-bar-height;
-}
-
-.navbar-nav {
-  li {
-    .badge {
-      position: inherit;
-      font-weight: $gl-font-weight-normal;
-      margin-left: -6px;
-      font-size: 11px;
-      color: $white-light;
-      padding: 0 5px;
-      line-height: 12px;
-      border-radius: 7px;
-      box-shadow: 0 1px 0 rgba($gl-header-color, .2);
-
-      &.issues-count {
-        background-color: $green-500;
-      }
-
-      &.merge-requests-count {
-        background-color: $orange-600;
-      }
-
-      &.todos-count {
-        background-color: $blue-500;
-      }
-    }
-  }
-}
-
-@media (max-width: $screen-xs-max) {
-  header .container-fluid {
-    font-size: 18px;
-
-    .navbar-nav {
-      display: table;
-      table-layout: fixed;
-      width: 100%;
-      margin: 0;
-      text-align: right;
-    }
-
-    .navbar-collapse {
-      padding-left: 5px;
-
-      .nav > li:not(.hidden-xs) {
-        display: table-cell !important;
-        width: 25%;
-
-        a {
-          margin-right: 8px;
-        }
-      }
-    }
-  }
-
-  .header-user-dropdown-toggle {
-    text-align: center;
-  }
-
-  .header-user-avatar {
-    float: none;
-  }
-}
-
-.header-user {
-  .dropdown-menu-nav {
-    width: auto;
-    min-width: 140px;
-    margin-top: -5px;
-    color: $gl-text-color;
-    left: auto;
-
-    .current-user {
-      padding: 5px 18px;
-
-      .user-name {
-        display: block;
-      }
-    }
-  }
-}
-
-.header-user-avatar {
-  float: left;
-  margin-right: 5px;
-  border-radius: 50%;
-  border: 1px solid $avatar-border;
-}
diff --git a/app/assets/stylesheets/framework/nav.scss b/app/assets/stylesheets/framework/nav.scss
index ca206ce818f..8b137891791 100644
--- a/app/assets/stylesheets/framework/nav.scss
+++ b/app/assets/stylesheets/framework/nav.scss
@@ -1,36 +1 @@
-.project-item-select-holder.btn-group {
-  display: flex;
-  max-width: 350px;
-  overflow: hidden;
-  float: right;
 
-  .new-project-item-link {
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-  }
-
-  .new-project-item-select-button {
-    width: 32px;
-  }
-}
-
-.empty-state .project-item-select-holder.btn-group {
-  float: none;
-  display: inline-block;
-
-  .btn {
-    // overrides styles applied to plain `.empty-state .btn`
-    margin: 10px 0;
-    max-width: 300px;
-    width: auto;
-
-    @media(max-width: $screen-xs-max) {
-      max-width: 250px;
-    }
-  }
-}
-
-.new-project-item-select-button .fa-caret-down {
-  margin-left: 2px;
-}
diff --git a/app/assets/stylesheets/framework/new-nav.scss b/app/assets/stylesheets/framework/new-nav.scss
index 3663ebf3039..0ee07b18b1f 100644
--- a/app/assets/stylesheets/framework/new-nav.scss
+++ b/app/assets/stylesheets/framework/new-nav.scss
@@ -397,3 +397,95 @@ header.navbar-gitlab-new {
     background-color: $white-light;
   }
 }
+
+.navbar-nav {
+  li {
+    .badge {
+      position: inherit;
+      font-weight: $gl-font-weight-normal;
+      margin-left: -6px;
+      font-size: 11px;
+      color: $white-light;
+      padding: 0 5px;
+      line-height: 12px;
+      border-radius: 7px;
+      box-shadow: 0 1px 0 rgba($gl-header-color, .2);
+
+      &.issues-count {
+        background-color: $green-500;
+      }
+
+      &.merge-requests-count {
+        background-color: $orange-600;
+      }
+
+      &.todos-count {
+        background-color: $blue-500;
+      }
+    }
+  }
+}
+
+@media (max-width: $screen-xs-max) {
+  header .container-fluid {
+    font-size: 18px;
+
+    .navbar-nav {
+      display: table;
+      table-layout: fixed;
+      width: 100%;
+      margin: 0;
+      text-align: right;
+    }
+
+    .navbar-collapse {
+      padding-left: 5px;
+
+      .nav > li:not(.hidden-xs) {
+        display: table-cell !important;
+        width: 25%;
+
+        a {
+          margin-right: 8px;
+        }
+      }
+    }
+  }
+
+  .header-user-dropdown-toggle {
+    text-align: center;
+  }
+
+  .header-user-avatar {
+    float: none;
+  }
+}
+
+.header-user {
+  .dropdown-menu-nav {
+    width: auto;
+    min-width: 140px;
+    margin-top: -5px;
+    color: $gl-text-color;
+    left: auto;
+
+    .current-user {
+      padding: 5px 18px;
+
+      .user-name {
+        display: block;
+      }
+    }
+  }
+}
+
+.header-user-avatar {
+  float: left;
+  margin-right: 5px;
+  border-radius: 50%;
+  border: 1px solid $avatar-border;
+}
+
+.with-performance-bar header.navbar-gitlab {
+  top: $performance-bar-height;
+}
diff --git a/app/assets/stylesheets/framework/secondary-navigation-elements.scss b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
index 5be6bae3368..5c96b3b78e7 100644
--- a/app/assets/stylesheets/framework/secondary-navigation-elements.scss
+++ b/app/assets/stylesheets/framework/secondary-navigation-elements.scss
@@ -337,3 +337,40 @@
     }
   }
 }
+
+.project-item-select-holder.btn-group {
+  display: flex;
+  max-width: 350px;
+  overflow: hidden;
+  float: right;
+
+  .new-project-item-link {
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+
+  .new-project-item-select-button {
+    width: 32px;
+  }
+}
+
+.empty-state .project-item-select-holder.btn-group {
+  float: none;
+  display: inline-block;
+
+  .btn {
+    // overrides styles applied to plain `.empty-state .btn`
+    margin: 10px 0;
+    max-width: 300px;
+    width: auto;
+
+    @media(max-width: $screen-xs-max) {
+      max-width: 250px;
+    }
+  }
+}
+
+.new-project-item-select-button .fa-caret-down {
+  margin-left: 2px;
+}
diff --git a/app/assets/stylesheets/pages/search.scss b/app/assets/stylesheets/pages/search.scss
index 89ebe3f9917..db0a04a5eb3 100644
--- a/app/assets/stylesheets/pages/search.scss
+++ b/app/assets/stylesheets/pages/search.scss
@@ -47,6 +47,7 @@ input[type="checkbox"]:hover {
   }
 
   .location-badge {
+    height: 32px;
     font-size: 12px;
     margin: -4px 4px -4px -4px;
     line-height: 25px;
-- 
cgit v1.2.1


From 940e702468ecd8c811dc2f2f4602c38ebffd9742 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Fri, 29 Sep 2017 14:03:50 -0700
Subject: Start moving new nav styles into header.scss

---
 app/assets/javascripts/shortcuts.js                |  15 --
 app/assets/stylesheets/framework/animations.scss   |   3 +-
 app/assets/stylesheets/framework/dropdowns.scss    |   2 +-
 app/assets/stylesheets/framework/gitlab-theme.scss |   4 +-
 app/assets/stylesheets/framework/header.scss       | 195 ++++++---------------
 app/assets/stylesheets/framework/new-nav.scss      |  86 +--------
 app/assets/stylesheets/framework/new-sidebar.scss  |  10 +-
 app/assets/stylesheets/framework/sidebar.scss      |   6 +-
 app/assets/stylesheets/framework/variables.scss    |   3 +-
 app/assets/stylesheets/pages/builds.scss           |   8 +-
 app/assets/stylesheets/pages/issuable.scss         |   6 +-
 app/assets/stylesheets/pages/merge_requests.scss   |   4 +-
 app/views/layouts/header/_default.html.haml        |   2 +-
 13 files changed, 76 insertions(+), 268 deletions(-)

diff --git a/app/assets/javascripts/shortcuts.js b/app/assets/javascripts/shortcuts.js
index e754f6c4460..f63b99ba1c5 100644
--- a/app/assets/javascripts/shortcuts.js
+++ b/app/assets/javascripts/shortcuts.js
@@ -18,23 +18,8 @@ import findAndFollowLink from './shortcuts_dashboard_navigation';
       Mousetrap.bind('f', (e => this.focusFilter(e)));
       Mousetrap.bind('p b', this.onTogglePerfBar);
 
-      const $globalDropdownMenu = $('.global-dropdown-menu');
-      const $globalDropdownToggle = $('.global-dropdown-toggle');
       const findFileURL = document.body.dataset.findFile;
 
-      $('.global-dropdown').on('hide.bs.dropdown', () => {
-        $globalDropdownMenu.removeClass('shortcuts');
-      });
-
-      Mousetrap.bind('n', () => {
-        $globalDropdownMenu.toggleClass('shortcuts');
-        $globalDropdownToggle.trigger('click');
-
-        if (!$globalDropdownMenu.is(':visible')) {
-          $globalDropdownToggle.blur();
-        }
-      });
-
       Mousetrap.bind('shift+t', () => findAndFollowLink('.shortcuts-todos'));
       Mousetrap.bind('shift+a', () => findAndFollowLink('.dashboard-shortcuts-activity'));
       Mousetrap.bind('shift+i', () => findAndFollowLink('.dashboard-shortcuts-issues'));
diff --git a/app/assets/stylesheets/framework/animations.scss b/app/assets/stylesheets/framework/animations.scss
index 667b73e150d..f0e6b23757f 100644
--- a/app/assets/stylesheets/framework/animations.scss
+++ b/app/assets/stylesheets/framework/animations.scss
@@ -115,8 +115,7 @@
   @return $unfoldedTransition;
 }
 
-.btn,
-.global-dropdown-toggle {
+.btn {
   @include transition(background-color, border-color, color, box-shadow);
 }
 
diff --git a/app/assets/stylesheets/framework/dropdowns.scss b/app/assets/stylesheets/framework/dropdowns.scss
index fa92d4ccf4f..9dcf332eee2 100644
--- a/app/assets/stylesheets/framework/dropdowns.scss
+++ b/app/assets/stylesheets/framework/dropdowns.scss
@@ -889,7 +889,7 @@
 @include new-style-dropdown('.breadcrumbs-list .dropdown ');
 @include new-style-dropdown('.js-namespace-select + ');
 
-header.navbar-gitlab-new .header-content .dropdown-menu.projects-dropdown-menu {
+header.header-content .dropdown-menu.projects-dropdown-menu {
   padding: 0;
 }
 
diff --git a/app/assets/stylesheets/framework/gitlab-theme.scss b/app/assets/stylesheets/framework/gitlab-theme.scss
index a6bdcf46aa7..45cf9b252a3 100644
--- a/app/assets/stylesheets/framework/gitlab-theme.scss
+++ b/app/assets/stylesheets/framework/gitlab-theme.scss
@@ -5,7 +5,7 @@
 @mixin gitlab-theme($color-100, $color-200, $color-500, $color-700, $color-800, $color-900, $color-alternate) {
   // Header
 
-  header.navbar-gitlab-new {
+  header {
     background-color: $color-900;
 
     .navbar-collapse {
@@ -200,7 +200,7 @@ body {
   &.ui_light {
     @include gitlab-theme($theme-gray-900, $theme-gray-700, $theme-gray-800, $theme-gray-700, $theme-gray-700, $theme-gray-100, $theme-gray-700);
 
-    header.navbar-gitlab-new {
+    header {
       background-color: $theme-gray-100;
       box-shadow: 0 2px 0 0 $border-color;
 
diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index 63eed636476..c10e3467bef 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -27,84 +27,28 @@ header {
     z-index: 1000;
     margin-bottom: 0;
     min-height: $header-height;
-    background-color: $gray-light;
     border: none;
     border-bottom: 1px solid $border-color;
     position: fixed;
     top: 0;
     left: 0;
     right: 0;
-    color: $gl-text-color-secondary;
     border-radius: 0;
 
-    @media (max-width: $screen-xs-min) {
-      padding: 0 16px;
-    }
-
-    &.with-horizontal-nav {
-      border-bottom: 0;
+    .logo-text {
+      line-height: initial;
 
-      .navbar-border {
-        height: 1px;
-        position: absolute;
-        right: 0;
-        left: 0;
-        bottom: -1px;
-        background-color: $border-color;
-        opacity: 0;
+      svg {
+        width: 55px;
+        height: 14px;
+        margin: 0;
+        fill: $white-light;
       }
     }
 
     .container-fluid {
-      width: 100% !important;
-      filter: none;
       padding: 0;
 
-      .nav > li > a {
-        color: currentColor;
-        font-size: 18px;
-        padding: 0;
-        margin: (($header-height - 28) / 2) 3px;
-        margin-left: 8px;
-        height: 28px;
-        min-width: 32px;
-        line-height: 28px;
-        text-align: center;
-
-        &.header-user-dropdown-toggle {
-          margin-left: 14px;
-
-          &:hover,
-          &:focus,
-          &:active {
-            .header-user-avatar {
-              border-color: rgba($avatar-border, .2);
-            }
-          }
-        }
-
-        &:hover,
-        &:focus,
-        &:active {
-          background-color: transparent;
-          color: $gl-text-color;
-
-          svg {
-            fill: $gl-text-color;
-          }
-        }
-
-        .fa-caret-down {
-          font-size: 14px;
-        }
-
-        .fa-chevron-down {
-          position: relative;
-          top: -3px;
-          font-size: 10px;
-        }
-      }
-
       .user-counter {
         svg {
           margin-right: 3px;
@@ -112,36 +56,34 @@ header {
       }
 
       .navbar-toggle {
-        color: $nav-toggle-gray;
-        margin: 5px 0;
-        border-radius: 0;
-        right: -10px;
-        padding: 6px 10px;
-
-        &:hover {
-          background-color: $white-normal;
-        }
+        min-width: 45px;
+        padding: 4px $gl-padding;
+        margin-right: -7px;
+        font-size: 14px;
+        text-align: center;
+        color: currentColor;
 
+        &:hover,
+        &:focus,
         &.active {
-          color: $gl-text-color-secondary;
+          color: currentColor;
+          background-color: transparent;
         }
       }
     }
   }
 
-  &.navbar-gitlab-new {
-    .close-icon {
+  .fa-times {
+    display: none;
+  }
+
+  .menu-expanded {
+    .fa-ellipsis-v {
       display: none;
     }
 
-    .menu-expanded {
-      .more-icon {
-        display: none;
-      }
-
-      .close-icon {
-        display: block;
-      }
+    .fa-times {
+      display: block;
     }
   }
 
@@ -160,29 +102,11 @@ header {
     }
   }
 
-  .global-dropdown-toggle {
-    margin: 7px 0;
-    font-size: 18px;
-    padding: 6px 10px;
-    border: none;
-    background-color: $gray-light;
-
-    &:hover {
-      background-color: $white-normal;
-    }
-
-    &:focus {
-      outline: none;
-      background-color: $white-normal;
-    }
-  }
-
   .header-content {
     display: flex;
-    justify-content: space-between;
     position: relative;
     min-height: $header-height;
-    padding-left: 30px;
+    padding-left: 0;
 
     &.menu-expanded {
       @media (max-width: $screen-xs-max) {
@@ -218,38 +142,32 @@ header {
       }
     }
 
-    .group-name-toggle {
-      margin: 3px 5px;
-    }
-
-    .group-title {
-      &.is-hidden {
-        .hidable:not(:last-of-type) {
-          display: none;
-        }
-      }
-    }
-
     .title-container {
       display: flex;
-      align-items: flex-start;
+      -webkit-align-items: stretch;
+      align-items: stretch;
+      -webkit-flex: 1 1 auto;
       flex: 1 1 auto;
-      padding-top: 14px;
-      overflow: hidden;
+      padding-top: 0;
+      overflow: visible;
     }
 
     .title {
+      padding-right: 0;
+      color: currentColor;
+      display: -webkit-flex;
+      display: flex;
       position: relative;
-      padding-right: 20px;
       margin: 0;
       font-size: 18px;
-      line-height: 22px;
-      display: inline-block;
-      font-weight: $gl-font-weight-normal;
-      color: $gl-text-color;
       vertical-align: top;
       white-space: nowrap;
 
+      img {
+        height: 28px;
+        margin-right: 8px;
+      }
+
       &.wrap {
         white-space: normal;
       }
@@ -259,30 +177,17 @@ header {
       }
 
       a {
-        color: currentColor;
+        display: -webkit-flex;
+        display: flex;
+        align-items: center;
+        padding: 2px 8px;
+        margin: 5px 2px 5px -8px;
+        border-radius: $border-radius-default;
 
-        &:hover {
-          text-decoration: underline;
-          color: $gl-header-nav-hover-color;
-        }
-      }
-
-      .dropdown-toggle-caret {
-        color: $gl-text-color;
-        border: transparent;
-        background: transparent;
-        position: absolute;
-        top: 2px;
-        right: 3px;
-        width: 12px;
-        line-height: 19px;
-        padding: 0;
-        font-size: 10px;
-        text-align: center;
-        cursor: pointer;
-
-        &:hover {
-          color: $gl-header-nav-hover-color;
+        svg {
+          @media (min-width: $screen-sm-min) {
+            margin-right: 8px;
+          }
         }
       }
 
diff --git a/app/assets/stylesheets/framework/new-nav.scss b/app/assets/stylesheets/framework/new-nav.scss
index 0ee07b18b1f..6120639f67f 100644
--- a/app/assets/stylesheets/framework/new-nav.scss
+++ b/app/assets/stylesheets/framework/new-nav.scss
@@ -1,67 +1,9 @@
 .content-wrapper.page-with-new-nav {
-  margin-top: $new-navbar-height;
+  margin-top: $header-height;
 }
 
-header.navbar-gitlab-new {
-  color: $white-light;
-  border-bottom: 0;
-  min-height: $new-navbar-height;
-
-  .logo-text {
-    line-height: initial;
-
-    svg {
-      width: 55px;
-      height: 14px;
-      margin: 0;
-      fill: $white-light;
-    }
-  }
-
+header {
   .header-content {
-    display: -webkit-flex;
-    display: flex;
-    padding-left: 0;
-    min-height: $new-navbar-height;
-
-    .title-container {
-      display: -webkit-flex;
-      display: flex;
-      -webkit-align-items: stretch;
-      align-items: stretch;
-      -webkit-flex: 1 1 auto;
-      flex: 1 1 auto;
-      padding-top: 0;
-      overflow: visible;
-    }
-
-    .title {
-      display: -webkit-flex;
-      display: flex;
-      padding-right: 0;
-      color: currentColor;
-
-      img {
-        height: 28px;
-        margin-right: 8px;
-      }
-
-      a {
-        display: -webkit-flex;
-        display: flex;
-        align-items: center;
-        padding: 2px 8px;
-        margin: 5px 2px 5px -8px;
-        border-radius: $border-radius-default;
-
-        svg {
-          @media (min-width: $screen-sm-min) {
-            margin-right: 8px;
-          }
-        }
-      }
-    }
-
     .dropdown.open {
       > a {
         border-bottom-color: $white-light;
@@ -113,28 +55,6 @@ header.navbar-gitlab-new {
   }
 
   .container-fluid {
-    .navbar-toggle {
-      min-width: 45px;
-      padding: 0 $gl-padding;
-      margin-right: -7px;
-      text-align: center;
-      color: currentColor;
-
-      svg {
-        fill: currentColor;
-      }
-
-      &:hover,
-      &:focus,
-      &.active {
-        color: currentColor;
-        background-color: transparent;
-
-        svg {
-          fill: currentColor;
-        }
-      }
-    }
 
     .navbar-nav {
       @media (max-width: $screen-xs-max) {
@@ -242,7 +162,7 @@ header.navbar-gitlab-new {
   }
 }
 
-.navbar-gitlab-new {
+header {
   .navbar-sub-nav,
   .navbar-nav {
     > li {
diff --git a/app/assets/stylesheets/framework/new-sidebar.scss b/app/assets/stylesheets/framework/new-sidebar.scss
index 8332cec2962..caf4c7a40b1 100644
--- a/app/assets/stylesheets/framework/new-sidebar.scss
+++ b/app/assets/stylesheets/framework/new-sidebar.scss
@@ -24,7 +24,7 @@ $new-sidebar-collapsed-width: 50px;
   // Override position: absolute
   .right-sidebar {
     position: fixed;
-    height: calc(100% - #{$new-navbar-height});
+    height: calc(100% - #{$header-height});
   }
 
   .issues-bulk-update.right-sidebar.right-sidebar-expanded .issuable-sidebar-header {
@@ -87,7 +87,7 @@ $new-sidebar-collapsed-width: 50px;
   z-index: 400;
   width: $new-sidebar-width;
   transition: left $sidebar-transition-duration;
-  top: $new-navbar-height;
+  top: $header-height;
   bottom: 0;
   left: 0;
   background-color: $gray-normal;
@@ -197,7 +197,7 @@ $new-sidebar-collapsed-width: 50px;
 }
 
 .with-performance-bar .nav-sidebar {
-  top: $new-navbar-height + $performance-bar-height;
+  top: $header-height + $performance-bar-height;
 }
 
 .sidebar-sub-level-items {
@@ -495,7 +495,7 @@ $new-sidebar-collapsed-width: 50px;
 // Make issue boards full-height now that sub-nav is gone
 
 .boards-list {
-  height: calc(100vh - #{$new-navbar-height});
+  height: calc(100vh - #{$header-height});
 
   @media (min-width: $screen-sm-min) {
     height: 475px; // Needed for PhantomJS
@@ -506,5 +506,5 @@ $new-sidebar-collapsed-width: 50px;
 }
 
 .with-performance-bar .boards-list {
-  height: calc(100vh - #{$new-navbar-height} - #{$performance-bar-height});
+  height: calc(100vh - #{$header-height} - #{$performance-bar-height});
 }
diff --git a/app/assets/stylesheets/framework/sidebar.scss b/app/assets/stylesheets/framework/sidebar.scss
index 48dc25d343b..ef58382ba41 100644
--- a/app/assets/stylesheets/framework/sidebar.scss
+++ b/app/assets/stylesheets/framework/sidebar.scss
@@ -78,16 +78,16 @@
 
 .right-sidebar {
   border-left: 1px solid $border-color;
-  height: calc(100% - #{$new-navbar-height});
+  height: calc(100% - #{$header-height});
 
   &.affix {
     position: fixed;
-    top: $new-navbar-height;
+    top: $header-height;
   }
 }
 
 .with-performance-bar .right-sidebar.affix {
-  top: $new-navbar-height + $performance-bar-height;
+  top: $header-height + $performance-bar-height;
 }
 
 @mixin maintain-sidebar-dimensions {
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 5ab40947da9..dd3038c0252 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -224,8 +224,7 @@ $gl-sidebar-padding: 22px;
 $row-hover: $blue-50;
 $row-hover-border: $blue-200;
 $progress-color: #c0392b;
-$header-height: 50px;
-$new-navbar-height: 40px;
+$header-height: 40px;
 $fixed-layout-width: 1280px;
 $limited-layout-width: 990px;
 $limited-layout-width-sm: 790px;
diff --git a/app/assets/stylesheets/pages/builds.scss b/app/assets/stylesheets/pages/builds.scss
index 359dd388d05..50ec5110bf1 100644
--- a/app/assets/stylesheets/pages/builds.scss
+++ b/app/assets/stylesheets/pages/builds.scss
@@ -64,10 +64,10 @@
     color: $gl-text-color;
     position: sticky;
     position: -webkit-sticky;
-    top: $new-navbar-height;
+    top: $header-height;
 
     &.affix {
-      top: $new-navbar-height;
+      top: $header-height;
     }
 
     // with sidebar
@@ -174,10 +174,10 @@
 
 .with-performance-bar .build-page {
   .top-bar {
-    top: $new-navbar-height + $performance-bar-height;
+    top: $header-height + $performance-bar-height;
 
     &.affix {
-      top: $new-navbar-height + $performance-bar-height;
+      top: $header-height + $performance-bar-height;
     }
   }
 }
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index db3b7e89d7b..dae3ec7ac42 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -222,7 +222,7 @@
 
 .right-sidebar {
   position: absolute;
-  top: $new-navbar-height;
+  top: $header-height;
   bottom: 0;
   right: 0;
   transition: width $right-sidebar-transition-duration;
@@ -487,10 +487,10 @@
 }
 
 .with-performance-bar .right-sidebar {
-  top: $new-navbar-height + $performance-bar-height;
+  top: $header-height + $performance-bar-height;
 
   .issuable-sidebar {
-    height: calc(100% - #{$new-navbar-height} - #{$performance-bar-height});
+    height: calc(100% - #{$header-height} - #{$performance-bar-height});
   }
 }
 
diff --git a/app/assets/stylesheets/pages/merge_requests.scss b/app/assets/stylesheets/pages/merge_requests.scss
index 09a14578dd3..d9fb3b44d29 100644
--- a/app/assets/stylesheets/pages/merge_requests.scss
+++ b/app/assets/stylesheets/pages/merge_requests.scss
@@ -649,7 +649,7 @@
 }
 
 .merge-request-tabs-holder {
-  top: $new-navbar-height;
+  top: $header-height;
   z-index: 200;
   background-color: $white-light;
   border-bottom: 1px solid $border-color;
@@ -679,7 +679,7 @@
 }
 
 .with-performance-bar .merge-request-tabs-holder {
-  top: $new-navbar-height + $performance-bar-height;
+  top: $header-height + $performance-bar-height;
 }
 
 .merge-request-tabs {
diff --git a/app/views/layouts/header/_default.html.haml b/app/views/layouts/header/_default.html.haml
index 7e9b76da570..3fbe318568e 100644
--- a/app/views/layouts/header/_default.html.haml
+++ b/app/views/layouts/header/_default.html.haml
@@ -1,4 +1,4 @@
-%header.navbar.navbar-gitlab.navbar-gitlab-new
+%header.navbar.navbar-gitlab
   %a.sr-only.gl-accessibility{ href: "#content-body", tabindex: "1" } Skip to content
   .container-fluid
     .header-content
-- 
cgit v1.2.1


From ac4e3cfee3e0f060105788db3f44aaf1ba821421 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Mon, 2 Oct 2017 07:57:15 -0700
Subject: Conflict fixes

---
 app/assets/stylesheets/framework/header.scss | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index c10e3467bef..32cf2f6aa3e 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -57,7 +57,7 @@ header {
 
       .navbar-toggle {
         min-width: 45px;
-        padding: 4px $gl-padding;
+        padding: 0 $gl-padding;
         margin-right: -7px;
         font-size: 14px;
         text-align: center;
@@ -73,16 +73,16 @@ header {
     }
   }
 
-  .fa-times {
+  .close-icon {
     display: none;
   }
 
   .menu-expanded {
-    .fa-ellipsis-v {
+    .more-icon {
       display: none;
     }
 
-    .fa-times {
+    .close-icon {
       display: block;
     }
   }
-- 
cgit v1.2.1


From e0f6525efed763e87ecf12e53076f636f4c0765b Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Mon, 2 Oct 2017 08:32:13 -0700
Subject: Fix specs

---
 app/assets/stylesheets/framework/header.scss  | 2 ++
 app/assets/stylesheets/framework/new-nav.scss | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index 32cf2f6aa3e..cd71d3c1dd9 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -103,6 +103,7 @@ header {
   }
 
   .header-content {
+    display: -webkit-flex;
     display: flex;
     position: relative;
     min-height: $header-height;
@@ -143,6 +144,7 @@ header {
     }
 
     .title-container {
+      display: -webkit-flex;
       display: flex;
       -webkit-align-items: stretch;
       align-items: stretch;
diff --git a/app/assets/stylesheets/framework/new-nav.scss b/app/assets/stylesheets/framework/new-nav.scss
index 6120639f67f..a8fe8b31a6b 100644
--- a/app/assets/stylesheets/framework/new-nav.scss
+++ b/app/assets/stylesheets/framework/new-nav.scss
@@ -58,6 +58,7 @@ header {
 
     .navbar-nav {
       @media (max-width: $screen-xs-max) {
+        display: -webkit-flex;
         display: flex;
         padding-right: 10px;
       }
@@ -178,6 +179,7 @@ header {
       }
 
       > a {
+        display: -webkit-flex;
         display: flex;
         align-items: center;
         justify-content: center;
@@ -214,6 +216,7 @@ header {
 }
 
 .breadcrumbs {
+  display: -webkit-flex;
   display: flex;
   min-height: 48px;
   color: $gl-text-color;
@@ -293,6 +296,7 @@ header {
 }
 
 .breadcrumbs-extra {
+  display: -webkit-flex;
   display: flex;
   flex: 0 0 auto;
   margin-left: auto;
-- 
cgit v1.2.1


From bc45fd78df153bec48bc759cddc370fba934d447 Mon Sep 17 00:00:00 2001
From: kushalpandya <kushal@gitlab.com>
Date: Fri, 6 Oct 2017 18:27:18 +0530
Subject: Remove unnecessary test

---
 spec/features/explore/new_menu_spec.rb | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/spec/features/explore/new_menu_spec.rb b/spec/features/explore/new_menu_spec.rb
index e1c74a24890..c5ec495a418 100644
--- a/spec/features/explore/new_menu_spec.rb
+++ b/spec/features/explore/new_menu_spec.rb
@@ -128,12 +128,6 @@ feature 'Top Plus Menu', :js do
       expect(find('.header-new.dropdown')).not_to have_selector('.header-new-project-snippet')
     end
 
-    scenario 'public project has no New Issue Button' do
-      visit project_path(public_project)
-
-      hasnot_topmenuitem("New issue")
-    end
-
     scenario 'public project has no New merge request menu item' do
       visit project_path(public_project)
 
-- 
cgit v1.2.1


From 55e6552c8d28d646a4b83777e8cb8f60681efc27 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Fri, 6 Oct 2017 19:47:00 +0000
Subject: Fix LDAP config key name

---
 doc/administration/auth/ldap.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/administration/auth/ldap.md b/doc/administration/auth/ldap.md
index ad904908472..ad903aef896 100644
--- a/doc/administration/auth/ldap.md
+++ b/doc/administration/auth/ldap.md
@@ -287,11 +287,11 @@ LDAP email address, and then sign into GitLab via their LDAP credentials.
 
 There are two encryption methods, `simple_tls` and `start_tls`.
 
-For either encryption method, if setting `validate_certificates: false`, TLS
+For either encryption method, if setting `verify_certificates: false`, TLS
 encryption is established with the LDAP server before any LDAP-protocol data is
 exchanged but no validation of the LDAP server's SSL certificate is performed.
 
->**Note**: Before GitLab 9.5, `validate_certificates: false` is the default if
+>**Note**: Before GitLab 9.5, `verify_certificates: false` is the default if
 unspecified.
 
 ## Limitations
-- 
cgit v1.2.1


From 75000979703a58297f76278c4b630ff026b9c50d Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 6 Oct 2017 13:00:50 -0700
Subject: Include GitLab full name with username in Slack messages

We used to include the first and last name of the user, but !6624 modified
this to include only the username. Let's compromise and add both in the form
of `First Last (username)`.

Closes #38865
---
 .../project_services/chat_message/base_message.rb  | 10 ++++++++++
 .../project_services/chat_message/issue_message.rb |  6 +++---
 .../project_services/chat_message/merge_message.rb |  4 ++--
 .../project_services/chat_message/note_message.rb  |  4 ++--
 .../chat_message/pipeline_message.rb               |  6 +++---
 .../project_services/chat_message/push_message.rb  |  8 ++++----
 .../chat_message/wiki_page_message.rb              |  4 ++--
 changelogs/unreleased/sh-show-all-slack-names.yml  |  5 +++++
 .../chat_message/issue_message_spec.rb             | 12 ++++++------
 .../chat_message/merge_message_spec.rb             | 12 ++++++------
 .../chat_message/note_message_spec.rb              | 22 +++++++++++-----------
 .../chat_message/pipeline_message_spec.rb          | 15 ++++++++-------
 .../chat_message/wiki_page_message_spec.rb         | 12 ++++++------
 13 files changed, 68 insertions(+), 52 deletions(-)
 create mode 100644 changelogs/unreleased/sh-show-all-slack-names.yml

diff --git a/app/models/project_services/chat_message/base_message.rb b/app/models/project_services/chat_message/base_message.rb
index e2ad586aea7..22a65b5145e 100644
--- a/app/models/project_services/chat_message/base_message.rb
+++ b/app/models/project_services/chat_message/base_message.rb
@@ -3,6 +3,7 @@ require 'slack-notifier'
 module ChatMessage
   class BaseMessage
     attr_reader :markdown
+    attr_reader :user_full_name
     attr_reader :user_name
     attr_reader :user_avatar
     attr_reader :project_name
@@ -12,10 +13,19 @@ module ChatMessage
       @markdown = params[:markdown] || false
       @project_name = params.dig(:project, :path_with_namespace) || params[:project_name]
       @project_url = params.dig(:project, :web_url) || params[:project_url]
+      @user_full_name = params.dig(:user, :name) || params[:user_full_name]
       @user_name = params.dig(:user, :username) || params[:user_name]
       @user_avatar = params.dig(:user, :avatar_url) || params[:user_avatar]
     end
 
+    def user_combined_name
+      if user_full_name.present?
+        "#{user_full_name} (#{user_name})"
+      else
+        user_name
+      end
+    end
+
     def pretext
       return message if markdown
 
diff --git a/app/models/project_services/chat_message/issue_message.rb b/app/models/project_services/chat_message/issue_message.rb
index 4b9a2b1e1f3..1327b075858 100644
--- a/app/models/project_services/chat_message/issue_message.rb
+++ b/app/models/project_services/chat_message/issue_message.rb
@@ -29,7 +29,7 @@ module ChatMessage
 
     def activity
       {
-        title: "Issue #{state} by #{user_name}",
+        title: "Issue #{state} by #{user_combined_name}",
         subtitle: "in #{project_link}",
         text: issue_link,
         image: user_avatar
@@ -40,9 +40,9 @@ module ChatMessage
 
     def message
       if state == 'opened'
-        "[#{project_link}] Issue #{state} by #{user_name}"
+        "[#{project_link}] Issue #{state} by #{user_combined_name}"
       else
-        "[#{project_link}] Issue #{issue_link} #{state} by #{user_name}"
+        "[#{project_link}] Issue #{issue_link} #{state} by #{user_combined_name}"
       end
     end
 
diff --git a/app/models/project_services/chat_message/merge_message.rb b/app/models/project_services/chat_message/merge_message.rb
index 7d0de81cdf0..f412b6833d9 100644
--- a/app/models/project_services/chat_message/merge_message.rb
+++ b/app/models/project_services/chat_message/merge_message.rb
@@ -24,7 +24,7 @@ module ChatMessage
 
     def activity
       {
-        title: "Merge Request #{state} by #{user_name}",
+        title: "Merge Request #{state} by #{user_combined_name}",
         subtitle: "in #{project_link}",
         text: merge_request_link,
         image: user_avatar
@@ -46,7 +46,7 @@ module ChatMessage
     end
 
     def merge_request_message
-      "#{user_name} #{state} #{merge_request_link} in #{project_link}: #{title}"
+      "#{user_combined_name} #{state} #{merge_request_link} in #{project_link}: #{title}"
     end
 
     def merge_request_link
diff --git a/app/models/project_services/chat_message/note_message.rb b/app/models/project_services/chat_message/note_message.rb
index 2da4c244229..7f9486132e6 100644
--- a/app/models/project_services/chat_message/note_message.rb
+++ b/app/models/project_services/chat_message/note_message.rb
@@ -32,7 +32,7 @@ module ChatMessage
 
     def activity
       {
-        title: "#{user_name} #{link('commented on ' + target, note_url)}",
+        title: "#{user_combined_name} #{link('commented on ' + target, note_url)}",
         subtitle: "in #{project_link}",
         text: formatted_title,
         image: user_avatar
@@ -42,7 +42,7 @@ module ChatMessage
     private
 
     def message
-      "#{user_name} #{link('commented on ' + target, note_url)} in #{project_link}: *#{formatted_title}*"
+      "#{user_combined_name} #{link('commented on ' + target, note_url)} in #{project_link}: *#{formatted_title}*"
     end
 
     def format_title(title)
diff --git a/app/models/project_services/chat_message/pipeline_message.rb b/app/models/project_services/chat_message/pipeline_message.rb
index d63d4ec2b12..2135122278a 100644
--- a/app/models/project_services/chat_message/pipeline_message.rb
+++ b/app/models/project_services/chat_message/pipeline_message.rb
@@ -9,7 +9,7 @@ module ChatMessage
     def initialize(data)
       super
 
-      @user_name = data.dig(:user, :name) || 'API'
+      @user_name = data.dig(:user, :username) || 'API'
 
       pipeline_attributes = data[:object_attributes]
       @ref_type = pipeline_attributes[:tag] ? 'tag' : 'branch'
@@ -35,7 +35,7 @@ module ChatMessage
 
     def activity
       {
-        title: "Pipeline #{pipeline_link} of #{ref_type} #{branch_link} by #{user_name} #{humanized_status}",
+        title: "Pipeline #{pipeline_link} of #{ref_type} #{branch_link} by #{user_combined_name} #{humanized_status}",
         subtitle: "in #{project_link}",
         text: "in #{pretty_duration(duration)}",
         image: user_avatar || ''
@@ -45,7 +45,7 @@ module ChatMessage
     private
 
     def message
-      "#{project_link}: Pipeline #{pipeline_link} of #{ref_type} #{branch_link} by #{user_name} #{humanized_status} in #{pretty_duration(duration)}"
+      "#{project_link}: Pipeline #{pipeline_link} of #{ref_type} #{branch_link} by #{user_combined_name} #{humanized_status} in #{pretty_duration(duration)}"
     end
 
     def humanized_status
diff --git a/app/models/project_services/chat_message/push_message.rb b/app/models/project_services/chat_message/push_message.rb
index c52dd6ef8ef..8d599c5f116 100644
--- a/app/models/project_services/chat_message/push_message.rb
+++ b/app/models/project_services/chat_message/push_message.rb
@@ -33,7 +33,7 @@ module ChatMessage
                end
 
       {
-        title: "#{user_name} #{action} #{ref_type}",
+        title: "#{user_combined_name} #{action} #{ref_type}",
         subtitle: "in #{project_link}",
         text: compare_link,
         image: user_avatar
@@ -57,15 +57,15 @@ module ChatMessage
     end
 
     def new_branch_message
-      "#{user_name} pushed new #{ref_type} #{branch_link} to #{project_link}"
+      "#{user_combined_name} pushed new #{ref_type} #{branch_link} to #{project_link}"
     end
 
     def removed_branch_message
-      "#{user_name} removed #{ref_type} #{ref} from #{project_link}"
+      "#{user_combined_name} removed #{ref_type} #{ref} from #{project_link}"
     end
 
     def push_message
-      "#{user_name} pushed to #{ref_type} #{branch_link} of #{project_link} (#{compare_link})"
+      "#{user_combined_name} pushed to #{ref_type} #{branch_link} of #{project_link} (#{compare_link})"
     end
 
     def commit_messages
diff --git a/app/models/project_services/chat_message/wiki_page_message.rb b/app/models/project_services/chat_message/wiki_page_message.rb
index a139a8ee727..d84b80f2de2 100644
--- a/app/models/project_services/chat_message/wiki_page_message.rb
+++ b/app/models/project_services/chat_message/wiki_page_message.rb
@@ -31,7 +31,7 @@ module ChatMessage
 
     def activity
       {
-        title: "#{user_name} #{action} #{wiki_page_link}",
+        title: "#{user_combined_name} #{action} #{wiki_page_link}",
         subtitle: "in #{project_link}",
         text: title,
         image: user_avatar
@@ -41,7 +41,7 @@ module ChatMessage
     private
 
     def message
-      "#{user_name} #{action} #{wiki_page_link} in #{project_link}: *#{title}*"
+      "#{user_combined_name} #{action} #{wiki_page_link} in #{project_link}: *#{title}*"
     end
 
     def description_message
diff --git a/changelogs/unreleased/sh-show-all-slack-names.yml b/changelogs/unreleased/sh-show-all-slack-names.yml
new file mode 100644
index 00000000000..f970cd0fb15
--- /dev/null
+++ b/changelogs/unreleased/sh-show-all-slack-names.yml
@@ -0,0 +1,5 @@
+---
+title: Include GitLab full name in Slack messages
+merge_request:
+author:
+type: changed
diff --git a/spec/models/project_services/chat_message/issue_message_spec.rb b/spec/models/project_services/chat_message/issue_message_spec.rb
index 4bb1db684e6..d37726dc3f1 100644
--- a/spec/models/project_services/chat_message/issue_message_spec.rb
+++ b/spec/models/project_services/chat_message/issue_message_spec.rb
@@ -42,7 +42,7 @@ describe ChatMessage::IssueMessage do
     context 'open' do
       it 'returns a message regarding opening of issues' do
         expect(subject.pretext).to eq(
-          '[<http://somewhere.com|project_name>] Issue opened by test.user')
+          '[<http://somewhere.com|project_name>] Issue opened by Test User (test.user)')
         expect(subject.attachments).to eq([
           {
             title: "#100 Issue title",
@@ -62,7 +62,7 @@ describe ChatMessage::IssueMessage do
 
       it 'returns a message regarding closing of issues' do
         expect(subject.pretext). to eq(
-          '[<http://somewhere.com|project_name>] Issue <http://url.com|#100 Issue title> closed by test.user')
+          '[<http://somewhere.com|project_name>] Issue <http://url.com|#100 Issue title> closed by Test User (test.user)')
         expect(subject.attachments).to be_empty
       end
     end
@@ -76,10 +76,10 @@ describe ChatMessage::IssueMessage do
     context 'open' do
       it 'returns a message regarding opening of issues' do
         expect(subject.pretext).to eq(
-          '[[project_name](http://somewhere.com)] Issue opened by test.user')
+          '[[project_name](http://somewhere.com)] Issue opened by Test User (test.user)')
         expect(subject.attachments).to eq('issue description')
         expect(subject.activity).to eq({
-          title: 'Issue opened by test.user',
+          title: 'Issue opened by Test User (test.user)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: '[#100 Issue title](http://url.com)',
           image: 'http://someavatar.com'
@@ -95,10 +95,10 @@ describe ChatMessage::IssueMessage do
 
       it 'returns a message regarding closing of issues' do
         expect(subject.pretext). to eq(
-          '[[project_name](http://somewhere.com)] Issue [#100 Issue title](http://url.com) closed by test.user')
+          '[[project_name](http://somewhere.com)] Issue [#100 Issue title](http://url.com) closed by Test User (test.user)')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
-          title: 'Issue closed by test.user',
+          title: 'Issue closed by Test User (test.user)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: '[#100 Issue title](http://url.com)',
           image: 'http://someavatar.com'
diff --git a/spec/models/project_services/chat_message/merge_message_spec.rb b/spec/models/project_services/chat_message/merge_message_spec.rb
index b600a36f578..184a07ae0f9 100644
--- a/spec/models/project_services/chat_message/merge_message_spec.rb
+++ b/spec/models/project_services/chat_message/merge_message_spec.rb
@@ -33,7 +33,7 @@ describe ChatMessage::MergeMessage do
     context 'open' do
       it 'returns a message regarding opening of merge requests' do
         expect(subject.pretext).to eq(
-          'test.user opened <http://somewhere.com/merge_requests/100|!100 *Merge Request title*> in <http://somewhere.com|project_name>: *Merge Request title*')
+          'Test User (test.user) opened <http://somewhere.com/merge_requests/100|!100 *Merge Request title*> in <http://somewhere.com|project_name>: *Merge Request title*')
         expect(subject.attachments).to be_empty
       end
     end
@@ -44,7 +44,7 @@ describe ChatMessage::MergeMessage do
       end
       it 'returns a message regarding closing of merge requests' do
         expect(subject.pretext).to eq(
-          'test.user closed <http://somewhere.com/merge_requests/100|!100 *Merge Request title*> in <http://somewhere.com|project_name>: *Merge Request title*')
+          'Test User (test.user) closed <http://somewhere.com/merge_requests/100|!100 *Merge Request title*> in <http://somewhere.com|project_name>: *Merge Request title*')
         expect(subject.attachments).to be_empty
       end
     end
@@ -58,10 +58,10 @@ describe ChatMessage::MergeMessage do
     context 'open' do
       it 'returns a message regarding opening of merge requests' do
         expect(subject.pretext).to eq(
-          'test.user opened [!100 *Merge Request title*](http://somewhere.com/merge_requests/100) in [project_name](http://somewhere.com): *Merge Request title*')
+          'Test User (test.user) opened [!100 *Merge Request title*](http://somewhere.com/merge_requests/100) in [project_name](http://somewhere.com): *Merge Request title*')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
-          title: 'Merge Request opened by test.user',
+          title: 'Merge Request opened by Test User (test.user)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: '[!100 *Merge Request title*](http://somewhere.com/merge_requests/100)',
           image: 'http://someavatar.com'
@@ -76,10 +76,10 @@ describe ChatMessage::MergeMessage do
 
       it 'returns a message regarding closing of merge requests' do
         expect(subject.pretext).to eq(
-          'test.user closed [!100 *Merge Request title*](http://somewhere.com/merge_requests/100) in [project_name](http://somewhere.com): *Merge Request title*')
+          'Test User (test.user) closed [!100 *Merge Request title*](http://somewhere.com/merge_requests/100) in [project_name](http://somewhere.com): *Merge Request title*')
         expect(subject.attachments).to be_empty
         expect(subject.activity).to eq({
-          title: 'Merge Request closed by test.user',
+          title: 'Merge Request closed by Test User (test.user)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: '[!100 *Merge Request title*](http://somewhere.com/merge_requests/100)',
           image: 'http://someavatar.com'
diff --git a/spec/models/project_services/chat_message/note_message_spec.rb b/spec/models/project_services/chat_message/note_message_spec.rb
index a09c2f9935c..5abbd7bec18 100644
--- a/spec/models/project_services/chat_message/note_message_spec.rb
+++ b/spec/models/project_services/chat_message/note_message_spec.rb
@@ -38,7 +38,7 @@ describe ChatMessage::NoteMessage do
 
     context 'without markdown' do
       it 'returns a message regarding notes on commits' do
-        expect(subject.pretext).to eq("test.user <http://url.com|commented on " \
+        expect(subject.pretext).to eq("Test User (test.user) <http://url.com|commented on " \
           "commit 5f163b2b> in <http://somewhere.com|project_name>: " \
           "*Added a commit message*")
         expect(subject.attachments).to eq([{
@@ -55,11 +55,11 @@ describe ChatMessage::NoteMessage do
 
       it 'returns a message regarding notes on commits' do
         expect(subject.pretext).to eq(
-          'test.user [commented on commit 5f163b2b](http://url.com) in [project_name](http://somewhere.com): *Added a commit message*'
+          'Test User (test.user) [commented on commit 5f163b2b](http://url.com) in [project_name](http://somewhere.com): *Added a commit message*'
         )
         expect(subject.attachments).to eq('comment on a commit')
         expect(subject.activity).to eq({
-          title: 'test.user [commented on commit 5f163b2b](http://url.com)',
+          title: 'Test User (test.user) [commented on commit 5f163b2b](http://url.com)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: 'Added a commit message',
           image: 'http://fakeavatar'
@@ -81,7 +81,7 @@ describe ChatMessage::NoteMessage do
 
     context 'without markdown' do
       it 'returns a message regarding notes on a merge request' do
-        expect(subject.pretext).to eq("test.user <http://url.com|commented on " \
+        expect(subject.pretext).to eq("Test User (test.user) <http://url.com|commented on " \
           "merge request !30> in <http://somewhere.com|project_name>: " \
           "*merge request title*")
         expect(subject.attachments).to eq([{
@@ -98,10 +98,10 @@ describe ChatMessage::NoteMessage do
 
       it 'returns a message regarding notes on a merge request' do
         expect(subject.pretext).to eq(
-          'test.user [commented on merge request !30](http://url.com) in [project_name](http://somewhere.com): *merge request title*')
+          'Test User (test.user) [commented on merge request !30](http://url.com) in [project_name](http://somewhere.com): *merge request title*')
         expect(subject.attachments).to eq('comment on a merge request')
         expect(subject.activity).to eq({
-          title: 'test.user [commented on merge request !30](http://url.com)',
+          title: 'Test User (test.user) [commented on merge request !30](http://url.com)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: 'merge request title',
           image: 'http://fakeavatar'
@@ -124,7 +124,7 @@ describe ChatMessage::NoteMessage do
     context 'without markdown' do
       it 'returns a message regarding notes on an issue' do
         expect(subject.pretext).to eq(
-          "test.user <http://url.com|commented on " \
+          "Test User (test.user) <http://url.com|commented on " \
             "issue #20> in <http://somewhere.com|project_name>: " \
             "*issue title*")
         expect(subject.attachments).to eq([{
@@ -141,10 +141,10 @@ describe ChatMessage::NoteMessage do
 
       it 'returns a message regarding notes on an issue' do
         expect(subject.pretext).to eq(
-          'test.user [commented on issue #20](http://url.com) in [project_name](http://somewhere.com): *issue title*')
+          'Test User (test.user) [commented on issue #20](http://url.com) in [project_name](http://somewhere.com): *issue title*')
         expect(subject.attachments).to eq('comment on an issue')
         expect(subject.activity).to eq({
-          title: 'test.user [commented on issue #20](http://url.com)',
+          title: 'Test User (test.user) [commented on issue #20](http://url.com)',
           subtitle: 'in [project_name](http://somewhere.com)',
           text: 'issue title',
           image: 'http://fakeavatar'
@@ -165,7 +165,7 @@ describe ChatMessage::NoteMessage do
 
     context 'without markdown' do
       it 'returns a message regarding notes on a project snippet' do
-        expect(subject.pretext).to eq("test.user <http://url.com|commented on " \
+        expect(subject.pretext).to eq("Test User (test.user) <http://url.com|commented on " \
           "snippet $5> in <http://somewhere.com|project_name>: " \
           "*snippet title*")
         expect(subject.attachments).to eq([{
@@ -182,7 +182,7 @@ describe ChatMessage::NoteMessage do
 
       it 'returns a message regarding notes on a project snippet' do
         expect(subject.pretext).to eq(
-          'test.user [commented on snippet $5](http://url.com) in [project_name](http://somewhere.com): *snippet title*')
+          'Test User (test.user) [commented on snippet $5](http://url.com) in [project_name](http://somewhere.com): *snippet title*')
         expect(subject.attachments).to eq('comment on a snippet')
       end
     end
diff --git a/spec/models/project_services/chat_message/pipeline_message_spec.rb b/spec/models/project_services/chat_message/pipeline_message_spec.rb
index 43b02568cb9..0ff20400999 100644
--- a/spec/models/project_services/chat_message/pipeline_message_spec.rb
+++ b/spec/models/project_services/chat_message/pipeline_message_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe ChatMessage::PipelineMessage do
   subject { described_class.new(args) }
 
-  let(:user) { { name: 'hacker' } }
+  let(:user) { { name: "The Hacker", username: 'hacker' } }
   let(:duration) { 7210 }
   let(:args) do
     {
@@ -22,12 +22,13 @@ describe ChatMessage::PipelineMessage do
       user: user
     }
   end
+  let(:combined_name) { "The Hacker (hacker)" }
 
   context 'without markdown' do
     context 'pipeline succeeded' do
       let(:status) { 'success' }
       let(:color) { 'good' }
-      let(:message) { build_message('passed') }
+      let(:message) { build_message('passed', combined_name) }
 
       it 'returns a message with information about succeeded build' do
         expect(subject.pretext).to be_empty
@@ -39,7 +40,7 @@ describe ChatMessage::PipelineMessage do
     context 'pipeline failed' do
       let(:status) { 'failed' }
       let(:color) { 'danger' }
-      let(:message) { build_message }
+      let(:message) { build_message(status, combined_name) }
 
       it 'returns a message with information about failed build' do
         expect(subject.pretext).to be_empty
@@ -75,13 +76,13 @@ describe ChatMessage::PipelineMessage do
     context 'pipeline succeeded' do
       let(:status) { 'success' }
       let(:color) { 'good' }
-      let(:message) { build_markdown_message('passed') }
+      let(:message) { build_markdown_message('passed', combined_name) }
 
       it 'returns a message with information about succeeded build' do
         expect(subject.pretext).to be_empty
         expect(subject.attachments).to eq(message)
         expect(subject.activity).to eq({
-          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by hacker passed',
+          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by The Hacker (hacker) passed',
           subtitle: 'in [project_name](http://example.gitlab.com)',
           text: 'in 02:00:10',
           image: ''
@@ -92,13 +93,13 @@ describe ChatMessage::PipelineMessage do
     context 'pipeline failed' do
       let(:status) { 'failed' }
       let(:color) { 'danger' }
-      let(:message) { build_markdown_message }
+      let(:message) { build_markdown_message(status, combined_name) }
 
       it 'returns a message with information about failed build' do
         expect(subject.pretext).to be_empty
         expect(subject.attachments).to eq(message)
         expect(subject.activity).to eq({
-          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by hacker failed',
+          title: 'Pipeline [#123](http://example.gitlab.com/pipelines/123) of branch [develop](http://example.gitlab.com/commits/develop) by The Hacker (hacker) failed',
           subtitle: 'in [project_name](http://example.gitlab.com)',
           text: 'in 02:00:10',
           image: ''
diff --git a/spec/models/project_services/chat_message/wiki_page_message_spec.rb b/spec/models/project_services/chat_message/wiki_page_message_spec.rb
index c4adee4f489..7efcba9bcfd 100644
--- a/spec/models/project_services/chat_message/wiki_page_message_spec.rb
+++ b/spec/models/project_services/chat_message/wiki_page_message_spec.rb
@@ -29,7 +29,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns a message that a new wiki page was created' do
           expect(subject.pretext).to eq(
-            'test.user created <http://url.com|wiki page> in <http://somewhere.com|project_name>: '\
+            'Test User (test.user) created <http://url.com|wiki page> in <http://somewhere.com|project_name>: '\
               '*Wiki page title*')
         end
       end
@@ -41,7 +41,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns a message that a wiki page was updated' do
           expect(subject.pretext).to eq(
-            'test.user edited <http://url.com|wiki page> in <http://somewhere.com|project_name>: '\
+            'Test User (test.user) edited <http://url.com|wiki page> in <http://somewhere.com|project_name>: '\
               '*Wiki page title*')
         end
       end
@@ -95,7 +95,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns a message that a new wiki page was created' do
           expect(subject.pretext).to eq(
-            'test.user created [wiki page](http://url.com) in [project_name](http://somewhere.com): *Wiki page title*')
+            'Test User (test.user) created [wiki page](http://url.com) in [project_name](http://somewhere.com): *Wiki page title*')
         end
       end
 
@@ -106,7 +106,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns a message that a wiki page was updated' do
           expect(subject.pretext).to eq(
-            'test.user edited [wiki page](http://url.com) in [project_name](http://somewhere.com): *Wiki page title*')
+            'Test User (test.user) edited [wiki page](http://url.com) in [project_name](http://somewhere.com): *Wiki page title*')
         end
       end
     end
@@ -141,7 +141,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns the attachment for a new wiki page' do
           expect(subject.activity).to eq({
-            title: 'test.user created [wiki page](http://url.com)',
+            title: 'Test User (test.user) created [wiki page](http://url.com)',
             subtitle: 'in [project_name](http://somewhere.com)',
             text: 'Wiki page title',
             image: 'http://someavatar.com'
@@ -156,7 +156,7 @@ describe ChatMessage::WikiPageMessage do
 
         it 'returns the attachment for an updated wiki page' do
           expect(subject.activity).to eq({
-            title: 'test.user edited [wiki page](http://url.com)',
+            title: 'Test User (test.user) edited [wiki page](http://url.com)',
             subtitle: 'in [project_name](http://somewhere.com)',
             text: 'Wiki page title',
             image: 'http://someavatar.com'
-- 
cgit v1.2.1


From e3fe48b85dc07b135180f8ec54db95537f794fdc Mon Sep 17 00:00:00 2001
From: Mike Greiling <mike@pixelcog.com>
Date: Fri, 6 Oct 2017 15:29:32 -0500
Subject: allow prometheus graphs to handle non-congiuous paths (with NaN,
 +Inf, and -Inf)

---
 app/assets/javascripts/monitoring/utils/multiple_time_series.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/assets/javascripts/monitoring/utils/multiple_time_series.js b/app/assets/javascripts/monitoring/utils/multiple_time_series.js
index 3cbe06d8fd6..65eec0d8d02 100644
--- a/app/assets/javascripts/monitoring/utils/multiple_time_series.js
+++ b/app/assets/javascripts/monitoring/utils/multiple_time_series.js
@@ -56,12 +56,16 @@ export default function createTimeSeries(queryData, graphWidth, graphHeight, gra
     timeSeriesScaleX.ticks(d3.time.minute, 60);
     timeSeriesScaleY.domain([0, maxValueFromSeries.maxValue]);
 
+    const defined = d => !isNaN(d.value) && d.value != null;
+
     const lineFunction = d3.svg.line()
+      .defined(defined)
       .interpolate('linear')
       .x(d => timeSeriesScaleX(d.time))
       .y(d => timeSeriesScaleY(d.value));
 
     const areaFunction = d3.svg.area()
+      .defined(defined)
       .interpolate('linear')
       .x(d => timeSeriesScaleX(d.time))
       .y0(graphHeight - graphHeightOffset)
-- 
cgit v1.2.1


From ece9621b1304c7ebc338a6765c7e9aed5126edaa Mon Sep 17 00:00:00 2001
From: Mike Greiling <mike@pixelcog.com>
Date: Fri, 6 Oct 2017 15:30:09 -0500
Subject: allow legend to properly handle NaN values

---
 app/assets/javascripts/monitoring/components/graph/legend.vue | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/monitoring/components/graph/legend.vue b/app/assets/javascripts/monitoring/components/graph/legend.vue
index dbc48c63747..85b6d7f4cbe 100644
--- a/app/assets/javascripts/monitoring/components/graph/legend.vue
+++ b/app/assets/javascripts/monitoring/components/graph/legend.vue
@@ -79,7 +79,11 @@
       },
 
       formatMetricUsage(series) {
-        return `${formatRelevantDigits(series.values[this.currentDataIndex].value)} ${this.unitOfDisplay}`;
+        const value = series.values[this.currentDataIndex].value;
+        if (isNaN(value)) {
+          return '-';
+        }
+        return `${formatRelevantDigits(value)} ${this.unitOfDisplay}`;
       },
 
       createSeriesString(index, series) {
-- 
cgit v1.2.1


From d13669716ab0c31ce9039ae9f7f073e33a4dc40f Mon Sep 17 00:00:00 2001
From: Toon Claes <toon@iotcl.com>
Date: Tue, 19 Sep 2017 09:44:58 +0200
Subject: Create idea of read-only database

In GitLab EE, a GitLab instance can be read-only (e.g. when it's a Geo
secondary node). But in GitLab CE it also might be useful to have the
"read-only" idea around. So port it back to GitLab CE.

Also having the principle of read-only in GitLab CE would hopefully
lead to less errors introduced, doing write operations when there
aren't allowed for read-only calls.

Closes gitlab-org/gitlab-ce#37534.
---
 app/controllers/admin/application_controller.rb    |  14 ++
 app/controllers/boards/issues_controller.rb        |   2 +-
 app/controllers/projects/lfs_api_controller.rb     |  18 +++
 .../merge_requests/application_controller.rb       |   2 +-
 app/controllers/sessions_controller.rb             |  37 +++---
 app/models/concerns/cache_markdown_field.rb        |  14 +-
 app/models/concerns/routable.rb                    |   2 +
 app/models/concerns/token_authenticatable.rb       |   4 +-
 app/models/merge_request.rb                        |   2 +-
 app/models/project.rb                              |   4 +-
 app/models/user.rb                                 |   8 ++
 app/services/keys/last_used_service.rb             |   2 +
 app/services/users/activity_service.rb             |   2 +-
 changelogs/unreleased/tc-geo-read-only-idea.yml    |   5 +
 config/application.rb                              |   3 +
 doc/development/verifying_database_capabilities.md |  12 ++
 lib/banzai/renderer.rb                             |   7 +-
 lib/gitlab/database.rb                             |   9 ++
 lib/gitlab/git_access.rb                           |   9 +-
 lib/gitlab/git_access_wiki.rb                      |   5 +
 lib/gitlab/middleware/read_only.rb                 |  88 +++++++++++++
 .../app/git_user_default_ssh_config_check.rb       |   4 +-
 spec/factories/projects.rb                         |   2 +-
 spec/lib/banzai/renderer_spec.rb                   |   9 +-
 spec/lib/gitlab/git_access_spec.rb                 |  23 ++++
 spec/lib/gitlab/git_access_wiki_spec.rb            |  29 +++--
 spec/lib/gitlab/middleware/read_only_spec.rb       | 142 +++++++++++++++++++++
 .../app/git_user_default_ssh_config_check_spec.rb  |   8 ++
 spec/models/concerns/cache_markdown_field_spec.rb  |  72 ++++++-----
 spec/models/concerns/routable_spec.rb              |  10 ++
 spec/models/project_spec.rb                        |  42 +++++-
 spec/requests/lfs_http_spec.rb                     |  28 ++++
 .../hashed_storage_migration_service_spec.rb       |   2 +-
 spec/services/users/activity_service_spec.rb       |  12 ++
 34 files changed, 546 insertions(+), 86 deletions(-)
 create mode 100644 changelogs/unreleased/tc-geo-read-only-idea.yml
 create mode 100644 lib/gitlab/middleware/read_only.rb
 create mode 100644 spec/lib/gitlab/middleware/read_only_spec.rb

diff --git a/app/controllers/admin/application_controller.rb b/app/controllers/admin/application_controller.rb
index a4648b33cfa..c27f2ee3c09 100644
--- a/app/controllers/admin/application_controller.rb
+++ b/app/controllers/admin/application_controller.rb
@@ -3,9 +3,23 @@
 # Automatically sets the layout and ensures an administrator is logged in
 class Admin::ApplicationController < ApplicationController
   before_action :authenticate_admin!
+  before_action :display_read_only_information
   layout 'admin'
 
   def authenticate_admin!
     render_404 unless current_user.admin?
   end
+
+  def display_read_only_information
+    return unless Gitlab::Database.read_only?
+
+    flash.now[:notice] = read_only_message
+  end
+
+  private
+
+  # Overridden in EE
+  def read_only_message
+    _('You are on a read-only GitLab instance.')
+  end
 end
diff --git a/app/controllers/boards/issues_controller.rb b/app/controllers/boards/issues_controller.rb
index 0d74078645a..737656b3dcc 100644
--- a/app/controllers/boards/issues_controller.rb
+++ b/app/controllers/boards/issues_controller.rb
@@ -10,7 +10,7 @@ module Boards
     def index
       issues = Boards::Issues::ListService.new(board_parent, current_user, filter_params).execute
       issues = issues.page(params[:page]).per(params[:per] || 20)
-      make_sure_position_is_set(issues)
+      make_sure_position_is_set(issues) if Gitlab::Database.read_write?
       issues = issues.preload(:project,
                               :milestone,
                               :assignees,
diff --git a/app/controllers/projects/lfs_api_controller.rb b/app/controllers/projects/lfs_api_controller.rb
index 1b0d3aab3fa..536f908d2c5 100644
--- a/app/controllers/projects/lfs_api_controller.rb
+++ b/app/controllers/projects/lfs_api_controller.rb
@@ -2,6 +2,7 @@ class Projects::LfsApiController < Projects::GitHttpClientController
   include LfsRequest
 
   skip_before_action :lfs_check_access!, only: [:deprecated]
+  before_action :lfs_check_batch_operation!, only: [:batch]
 
   def batch
     unless objects.present?
@@ -90,4 +91,21 @@ class Projects::LfsApiController < Projects::GitHttpClientController
       }
     }
   end
+
+  def lfs_check_batch_operation!
+    if upload_request? && Gitlab::Database.read_only?
+      render(
+        json: {
+          message: lfs_read_only_message
+        },
+        content_type: 'application/vnd.git-lfs+json',
+        status: 403
+      )
+    end
+  end
+
+  # Overridden in EE
+  def lfs_read_only_message
+    _('You cannot write to this read-only GitLab instance.')
+  end
 end
diff --git a/app/controllers/projects/merge_requests/application_controller.rb b/app/controllers/projects/merge_requests/application_controller.rb
index eb7d7bf374c..0e71977a58a 100644
--- a/app/controllers/projects/merge_requests/application_controller.rb
+++ b/app/controllers/projects/merge_requests/application_controller.rb
@@ -13,7 +13,7 @@ class Projects::MergeRequests::ApplicationController < Projects::ApplicationCont
   # Make sure merge requests created before 8.0
   # have head file in refs/merge-requests/
   def ensure_ref_fetched
-    @merge_request.ensure_ref_fetched
+    @merge_request.ensure_ref_fetched if Gitlab::Database.read_write?
   end
 
   def merge_request_params
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index ada91694fd6..c01be42c3ee 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -8,8 +8,7 @@ class SessionsController < Devise::SessionsController
   prepend_before_action :check_initial_setup, only: [:new]
   prepend_before_action :authenticate_with_two_factor,
     if: :two_factor_enabled?, only: [:create]
-  prepend_before_action :store_redirect_path, only: [:new]
-
+  prepend_before_action :store_redirect_uri, only: [:new]
   before_action :auto_sign_in_with_provider, only: [:new]
   before_action :load_recaptcha
 
@@ -86,28 +85,36 @@ class SessionsController < Devise::SessionsController
     end
   end
 
-  def store_redirect_path
-    redirect_path =
+  def stored_redirect_uri
+    @redirect_to ||= stored_location_for(:redirect)
+  end
+
+  def store_redirect_uri
+    redirect_uri =
       if request.referer.present? && (params['redirect_to_referer'] == 'yes')
-        referer_uri = URI(request.referer)
-        if referer_uri.host == Gitlab.config.gitlab.host
-          referer_uri.request_uri
-        else
-          request.fullpath
-        end
+        URI(request.referer)
       else
-        request.fullpath
+        URI(request.url)
       end
 
     # Prevent a 'you are already signed in' message directly after signing:
     # we should never redirect to '/users/sign_in' after signing in successfully.
-    unless URI(redirect_path).path == new_user_session_path
-      store_location_for(:redirect, redirect_path)
-    end
+    return true if redirect_uri.path == new_user_session_path
+
+    redirect_to = redirect_uri.to_s if redirect_allowed_to?(redirect_uri)
+
+    @redirect_to = redirect_to
+    store_location_for(:redirect, redirect_to)
+  end
+
+  # Overridden in EE
+  def redirect_allowed_to?(uri)
+    uri.host == Gitlab.config.gitlab.host &&
+      uri.port == Gitlab.config.gitlab.port
   end
 
   def two_factor_enabled?
-    find_user.try(:two_factor_enabled?)
+    find_user&.two_factor_enabled?
   end
 
   def auto_sign_in_with_provider
diff --git a/app/models/concerns/cache_markdown_field.rb b/app/models/concerns/cache_markdown_field.rb
index 193e459977a..9417033d1f6 100644
--- a/app/models/concerns/cache_markdown_field.rb
+++ b/app/models/concerns/cache_markdown_field.rb
@@ -59,7 +59,7 @@ module CacheMarkdownField
 
   # Update every column in a row if any one is invalidated, as we only store
   # one version per row
-  def refresh_markdown_cache!(do_update: false)
+  def refresh_markdown_cache
     options = { skip_project_check: skip_project_check? }
 
     updates = cached_markdown_fields.markdown_fields.map do |markdown_field|
@@ -71,8 +71,14 @@ module CacheMarkdownField
     updates['cached_markdown_version'] = CacheMarkdownField::CACHE_VERSION
 
     updates.each {|html_field, data| write_attribute(html_field, data) }
+  end
+
+  def refresh_markdown_cache!
+    updates = refresh_markdown_cache
+
+    return unless persisted? && Gitlab::Database.read_write?
 
-    update_columns(updates) if persisted? && do_update
+    update_columns(updates)
   end
 
   def cached_html_up_to_date?(markdown_field)
@@ -124,8 +130,8 @@ module CacheMarkdownField
     end
 
     # Using before_update here conflicts with elasticsearch-model somehow
-    before_create :refresh_markdown_cache!, if: :invalidated_markdown_cache?
-    before_update :refresh_markdown_cache!, if: :invalidated_markdown_cache?
+    before_create :refresh_markdown_cache, if: :invalidated_markdown_cache?
+    before_update :refresh_markdown_cache, if: :invalidated_markdown_cache?
   end
 
   class_methods do
diff --git a/app/models/concerns/routable.rb b/app/models/concerns/routable.rb
index 12e93be2104..22fde2eb134 100644
--- a/app/models/concerns/routable.rb
+++ b/app/models/concerns/routable.rb
@@ -156,6 +156,8 @@ module Routable
   end
 
   def update_route
+    return if Gitlab::Database.read_only?
+
     prepare_route
     route.save
   end
diff --git a/app/models/concerns/token_authenticatable.rb b/app/models/concerns/token_authenticatable.rb
index a7d5de48c66..ec3543f7053 100644
--- a/app/models/concerns/token_authenticatable.rb
+++ b/app/models/concerns/token_authenticatable.rb
@@ -43,15 +43,17 @@ module TokenAuthenticatable
         write_attribute(token_field, token) if token
       end
 
+      # Returns a token, but only saves when the database is in read & write mode
       define_method("ensure_#{token_field}!") do
         send("reset_#{token_field}!") if read_attribute(token_field).blank? # rubocop:disable GitlabSecurity/PublicSend
 
         read_attribute(token_field)
       end
 
+      # Resets the token, but only saves when the database is in read & write mode
       define_method("reset_#{token_field}!") do
         write_new_token(token_field)
-        save!
+        save! if Gitlab::Database.read_write?
       end
     end
   end
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 086226618e6..992cf63b704 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -477,7 +477,7 @@ class MergeRequest < ActiveRecord::Base
   end
 
   def check_if_can_be_merged
-    return unless unchecked?
+    return unless unchecked? && Gitlab::Database.read_write?
 
     can_be_merged =
       !broken? && project.repository.can_be_merged?(diff_head_sha, target_branch)
diff --git a/app/models/project.rb b/app/models/project.rb
index e51e70f01b7..523ac6cccd7 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -814,7 +814,7 @@ class Project < ActiveRecord::Base
   end
 
   def cache_has_external_issue_tracker
-    update_column(:has_external_issue_tracker, services.external_issue_trackers.any?)
+    update_column(:has_external_issue_tracker, services.external_issue_trackers.any?) if Gitlab::Database.read_write?
   end
 
   def has_wiki?
@@ -834,7 +834,7 @@ class Project < ActiveRecord::Base
   end
 
   def cache_has_external_wiki
-    update_column(:has_external_wiki, services.external_wikis.any?)
+    update_column(:has_external_wiki, services.external_wikis.any?) if Gitlab::Database.read_write?
   end
 
   def find_or_initialize_services(exceptions: [])
diff --git a/app/models/user.rb b/app/models/user.rb
index 4ba9130a75a..7780afe5608 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -459,6 +459,14 @@ class User < ActiveRecord::Base
     reset_password_sent_at.present? && reset_password_sent_at >= 1.minute.ago
   end
 
+  def remember_me!
+    super if ::Gitlab::Database.read_write?
+  end
+
+  def forget_me!
+    super if ::Gitlab::Database.read_write?
+  end
+
   def disable_two_factor!
     transaction do
       update_attributes(
diff --git a/app/services/keys/last_used_service.rb b/app/services/keys/last_used_service.rb
index 066f3246158..dbd79f7da55 100644
--- a/app/services/keys/last_used_service.rb
+++ b/app/services/keys/last_used_service.rb
@@ -16,6 +16,8 @@ module Keys
     end
 
     def update?
+      return false if ::Gitlab::Database.read_only?
+
       last_used = key.last_used_at
 
       return false if last_used && (Time.zone.now - last_used) <= TIMEOUT
diff --git a/app/services/users/activity_service.rb b/app/services/users/activity_service.rb
index ab532a1fdcf..5803404c3c8 100644
--- a/app/services/users/activity_service.rb
+++ b/app/services/users/activity_service.rb
@@ -14,7 +14,7 @@ module Users
     private
 
     def record_activity
-      Gitlab::UserActivities.record(@author.id)
+      Gitlab::UserActivities.record(@author.id) if Gitlab::Database.read_write?
 
       Rails.logger.debug("Recorded activity: #{@activity} for User ID: #{@author.id} (username: #{@author.username})")
     end
diff --git a/changelogs/unreleased/tc-geo-read-only-idea.yml b/changelogs/unreleased/tc-geo-read-only-idea.yml
new file mode 100644
index 00000000000..e1b52eef2ca
--- /dev/null
+++ b/changelogs/unreleased/tc-geo-read-only-idea.yml
@@ -0,0 +1,5 @@
+---
+title: Create idea of read-only database
+merge_request: 14688
+author:
+type: changed
diff --git a/config/application.rb b/config/application.rb
index ca2ab83becc..31e91835b9e 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -154,6 +154,9 @@ module Gitlab
     ENV['GITLAB_PATH_OUTSIDE_HOOK'] = ENV['PATH']
     ENV['GIT_TERMINAL_PROMPT'] = '0'
 
+    # Gitlab Read-only middleware support
+    config.middleware.insert_after ActionDispatch::Flash, 'Gitlab::Middleware::ReadOnly'
+
     config.generators do |g|
       g.factory_girl false
     end
diff --git a/doc/development/verifying_database_capabilities.md b/doc/development/verifying_database_capabilities.md
index cc6d62957e3..ffdeff47d4a 100644
--- a/doc/development/verifying_database_capabilities.md
+++ b/doc/development/verifying_database_capabilities.md
@@ -24,3 +24,15 @@ else
   run_query
 end
 ```
+
+# Read-only database
+
+The database can be used in read-only mode. In this case we have to
+make sure all GET requests don't attempt any write operations to the
+database. If one of those requests wants to write to the database, it needs
+to be wrapped in a `Gitlab::Database.read_only?` or `Gitlab::Database.read_write?`
+guard, to make sure it doesn't for read-only databases.
+
+We have a Rails Middleware that filters any potentially writing
+operations (the CUD operations of CRUD) and prevent the user from trying
+to update the database and getting a 500 error (see `Gitlab::Middleware::ReadOnly`).
diff --git a/lib/banzai/renderer.rb b/lib/banzai/renderer.rb
index ceca9296851..5f91884a878 100644
--- a/lib/banzai/renderer.rb
+++ b/lib/banzai/renderer.rb
@@ -40,7 +40,7 @@ module Banzai
         return cacheless_render_field(object, field)
       end
 
-      object.refresh_markdown_cache!(do_update: update_object?(object)) unless object.cached_html_up_to_date?(field)
+      object.refresh_markdown_cache! unless object.cached_html_up_to_date?(field)
 
       object.cached_html_for(field)
     end
@@ -162,10 +162,5 @@ module Banzai
       return unless cache_key
       Rails.cache.__send__(:expanded_key, full_cache_key(cache_key, pipeline_name)) # rubocop:disable GitlabSecurity/PublicSend
     end
-
-    # GitLab EE needs to disable updates on GET requests in Geo
-    def self.update_object?(object)
-      true
-    end
   end
 end
diff --git a/lib/gitlab/database.rb b/lib/gitlab/database.rb
index a6ec75da385..357f16936c6 100644
--- a/lib/gitlab/database.rb
+++ b/lib/gitlab/database.rb
@@ -29,6 +29,15 @@ module Gitlab
       adapter_name.casecmp('postgresql').zero?
     end
 
+    # Overridden in EE
+    def self.read_only?
+      false
+    end
+
+    def self.read_write?
+      !self.read_only?
+    end
+
     def self.version
       database_version.match(/\A(?:PostgreSQL |)([^\s]+).*\z/)[1]
     end
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index db67ede9d9e..42b59c106e2 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -17,7 +17,8 @@ module Gitlab
       command_not_allowed: "The command you're trying to execute is not allowed.",
       upload_pack_disabled_over_http: 'Pulling over HTTP is not allowed.',
       receive_pack_disabled_over_http: 'Pushing over HTTP is not allowed.',
-      readonly: 'The repository is temporarily read-only. Please try again later.'
+      read_only: 'The repository is temporarily read-only. Please try again later.',
+      cannot_push_to_read_only: "You can't push code to a read-only GitLab instance."
     }.freeze
 
     DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }.freeze
@@ -161,7 +162,11 @@ module Gitlab
 
     def check_push_access!(changes)
       if project.repository_read_only?
-        raise UnauthorizedError, ERROR_MESSAGES[:readonly]
+        raise UnauthorizedError, ERROR_MESSAGES[:read_only]
+      end
+
+      if Gitlab::Database.read_only?
+        raise UnauthorizedError, ERROR_MESSAGES[:cannot_push_to_read_only]
       end
 
       if deploy_key
diff --git a/lib/gitlab/git_access_wiki.rb b/lib/gitlab/git_access_wiki.rb
index 1fe5155c093..98f1f45b338 100644
--- a/lib/gitlab/git_access_wiki.rb
+++ b/lib/gitlab/git_access_wiki.rb
@@ -1,6 +1,7 @@
 module Gitlab
   class GitAccessWiki < GitAccess
     ERROR_MESSAGES = {
+      read_only:     "You can't push code to a read-only GitLab instance.",
       write_to_wiki: "You are not allowed to write to this project's wiki."
     }.freeze
 
@@ -17,6 +18,10 @@ module Gitlab
         raise UnauthorizedError, ERROR_MESSAGES[:write_to_wiki]
       end
 
+      if Gitlab::Database.read_only?
+        raise UnauthorizedError, ERROR_MESSAGES[:read_only]
+      end
+
       true
     end
   end
diff --git a/lib/gitlab/middleware/read_only.rb b/lib/gitlab/middleware/read_only.rb
new file mode 100644
index 00000000000..0de0cddcce4
--- /dev/null
+++ b/lib/gitlab/middleware/read_only.rb
@@ -0,0 +1,88 @@
+module Gitlab
+  module Middleware
+    class ReadOnly
+      DISALLOWED_METHODS = %w(POST PATCH PUT DELETE).freeze
+      APPLICATION_JSON = 'application/json'.freeze
+      API_VERSIONS = (3..4)
+
+      def initialize(app)
+        @app = app
+        @whitelisted = internal_routes
+      end
+
+      def call(env)
+        @env = env
+
+        if disallowed_request? && Gitlab::Database.read_only?
+          Rails.logger.debug('GitLab ReadOnly: preventing possible non read-only operation')
+          error_message = 'You cannot do writing operations on a read-only GitLab instance'
+
+          if json_request?
+            return [403, { 'Content-Type' => 'application/json' }, [{ 'message' => error_message }.to_json]]
+          else
+            rack_flash.alert = error_message
+            rack_session['flash'] = rack_flash.to_session_value
+
+            return [301, { 'Location' => last_visited_url }, []]
+          end
+        end
+
+        @app.call(env)
+      end
+
+      private
+
+      def internal_routes
+        API_VERSIONS.flat_map { |version| "api/v#{version}/internal" }
+      end
+
+      def disallowed_request?
+        DISALLOWED_METHODS.include?(@env['REQUEST_METHOD']) && !whitelisted_routes
+      end
+
+      def json_request?
+        request.media_type == APPLICATION_JSON
+      end
+
+      def rack_flash
+        @rack_flash ||= ActionDispatch::Flash::FlashHash.from_session_value(rack_session)
+      end
+
+      def rack_session
+        @env['rack.session']
+      end
+
+      def request
+        @env['rack.request'] ||= Rack::Request.new(@env)
+      end
+
+      def last_visited_url
+        @env['HTTP_REFERER'] || rack_session['user_return_to'] || Rails.application.routes.url_helpers.root_url
+      end
+
+      def route_hash
+        @route_hash ||= Rails.application.routes.recognize_path(request.url, { method: request.request_method }) rescue {}
+      end
+
+      def whitelisted_routes
+        logout_route || grack_route || @whitelisted.any? { |path| request.path.include?(path) } || lfs_route || sidekiq_route
+      end
+
+      def logout_route
+        route_hash[:controller] == 'sessions' && route_hash[:action] == 'destroy'
+      end
+
+      def sidekiq_route
+        request.path.start_with?('/admin/sidekiq')
+      end
+
+      def grack_route
+        request.path.end_with?('.git/git-upload-pack')
+      end
+
+      def lfs_route
+        request.path.end_with?('/info/lfs/objects/batch')
+      end
+    end
+  end
+end
diff --git a/lib/system_check/app/git_user_default_ssh_config_check.rb b/lib/system_check/app/git_user_default_ssh_config_check.rb
index dfa8b8b3f5b..9af21078403 100644
--- a/lib/system_check/app/git_user_default_ssh_config_check.rb
+++ b/lib/system_check/app/git_user_default_ssh_config_check.rb
@@ -11,10 +11,10 @@ module SystemCheck
       ].freeze
 
       set_name 'Git user has default SSH configuration?'
-      set_skip_reason 'skipped (git user is not present or configured)'
+      set_skip_reason 'skipped (GitLab read-only, or git user is not present / configured)'
 
       def skip?
-        !home_dir || !File.directory?(home_dir)
+        Gitlab::Database.read_only? || !home_dir || !File.directory?(home_dir)
       end
 
       def check?
diff --git a/spec/factories/projects.rb b/spec/factories/projects.rb
index 958d62181a2..4034e7905ad 100644
--- a/spec/factories/projects.rb
+++ b/spec/factories/projects.rb
@@ -149,7 +149,7 @@ FactoryGirl.define do
       end
     end
 
-    trait :readonly do
+    trait :read_only do
       repository_read_only true
     end
 
diff --git a/spec/lib/banzai/renderer_spec.rb b/spec/lib/banzai/renderer_spec.rb
index da42272bbef..81a04a2d46d 100644
--- a/spec/lib/banzai/renderer_spec.rb
+++ b/spec/lib/banzai/renderer_spec.rb
@@ -31,7 +31,14 @@ describe Banzai::Renderer do
         let(:object) { fake_object(fresh: false) }
 
         it 'caches and returns the result' do
-          expect(object).to receive(:refresh_markdown_cache!).with(do_update: true)
+          expect(object).to receive(:refresh_markdown_cache!)
+
+          is_expected.to eq('field_html')
+        end
+
+        it "skips database caching on a GitLab read-only instance" do
+          allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+          expect(object).to receive(:refresh_markdown_cache!)
 
           is_expected.to eq('field_html')
         end
diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb
index 458627ee4de..c54327bd2e4 100644
--- a/spec/lib/gitlab/git_access_spec.rb
+++ b/spec/lib/gitlab/git_access_spec.rb
@@ -598,6 +598,19 @@ describe Gitlab::GitAccess do
                                                             admin: { push_protected_branch: false, push_all: false, merge_into_protected_branch: false }))
       end
     end
+
+    context "when in a read-only GitLab instance" do
+      before do
+        create(:protected_branch, name: 'feature', project: project)
+        allow(Gitlab::Database).to receive(:read_only?) { true }
+      end
+
+      # Only check admin; if an admin can't do it, other roles can't either
+      matrix = permissions_matrix[:admin].dup
+      matrix.each { |key, _| matrix[key] = false }
+
+      run_permission_checks(admin: matrix)
+    end
   end
 
   describe 'build authentication abilities' do
@@ -632,6 +645,16 @@ describe Gitlab::GitAccess do
     end
   end
 
+  context 'when the repository is read only' do
+    let(:project) { create(:project, :repository, :read_only) }
+
+    it 'denies push access' do
+      project.add_master(user)
+
+      expect { push_access_check }.to raise_unauthorized('The repository is temporarily read-only. Please try again later.')
+    end
+  end
+
   describe 'deploy key permissions' do
     let(:key) { create(:deploy_key, user: user, can_push: can_push) }
     let(:actor) { key }
diff --git a/spec/lib/gitlab/git_access_wiki_spec.rb b/spec/lib/gitlab/git_access_wiki_spec.rb
index 0376b4ee783..1056074264a 100644
--- a/spec/lib/gitlab/git_access_wiki_spec.rb
+++ b/spec/lib/gitlab/git_access_wiki_spec.rb
@@ -4,6 +4,7 @@ describe Gitlab::GitAccessWiki do
   let(:access) { described_class.new(user, project, 'web', authentication_abilities: authentication_abilities, redirected_path: redirected_path) }
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
+  let(:changes) { ['6f6d7e7ed 570e7b2ab refs/heads/master'] }
   let(:redirected_path) { nil }
   let(:authentication_abilities) do
     [
@@ -13,19 +14,27 @@ describe Gitlab::GitAccessWiki do
     ]
   end
 
-  describe 'push_allowed?' do
-    before do
-      create(:protected_branch, name: 'master', project: project)
-      project.team << [user, :developer]
-    end
+  describe '#push_access_check' do
+    context 'when user can :create_wiki' do
+      before do
+        create(:protected_branch, name: 'master', project: project)
+        project.team << [user, :developer]
+      end
 
-    subject { access.check('git-receive-pack', changes) }
+      subject { access.check('git-receive-pack', changes) }
 
-    it { expect { subject }.not_to raise_error }
-  end
+      it { expect { subject }.not_to raise_error }
+
+      context 'when in a read-only GitLab instance' do
+        before do
+          allow(Gitlab::Database).to receive(:read_only?) { true }
+        end
 
-  def changes
-    ['6f6d7e7ed 570e7b2ab refs/heads/master']
+        it 'does not give access to upload wiki code' do
+          expect { subject }.to raise_error(Gitlab::GitAccess::UnauthorizedError, "You can't push code to a read-only GitLab instance.")
+        end
+      end
+    end
   end
 
   describe '#access_check_download!' do
diff --git a/spec/lib/gitlab/middleware/read_only_spec.rb b/spec/lib/gitlab/middleware/read_only_spec.rb
new file mode 100644
index 00000000000..742a792a1af
--- /dev/null
+++ b/spec/lib/gitlab/middleware/read_only_spec.rb
@@ -0,0 +1,142 @@
+require 'spec_helper'
+
+describe Gitlab::Middleware::ReadOnly do
+  include Rack::Test::Methods
+
+  RSpec::Matchers.define :be_a_redirect do
+    match do |response|
+      response.status == 301
+    end
+  end
+
+  RSpec::Matchers.define :disallow_request do
+    match do |middleware|
+      flash = middleware.send(:rack_flash)
+      flash['alert'] && flash['alert'].include?('You cannot do writing operations')
+    end
+  end
+
+  RSpec::Matchers.define :disallow_request_in_json do
+    match do |response|
+      json_response = JSON.parse(response.body)
+      response.body.include?('You cannot do writing operations') && json_response.key?('message')
+    end
+  end
+
+  let(:rack_stack) do
+    rack = Rack::Builder.new do
+      use ActionDispatch::Session::CacheStore
+      use ActionDispatch::Flash
+      use ActionDispatch::ParamsParser
+    end
+
+    rack.run(subject)
+    rack.to_app
+  end
+
+  subject { described_class.new(fake_app) }
+
+  let(:request) { Rack::MockRequest.new(rack_stack) }
+
+  context 'normal requests to a read-only Gitlab instance' do
+    let(:fake_app) { lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ['OK']] } }
+
+    before do
+      allow(Gitlab::Database).to receive(:read_only?) { true }
+    end
+
+    it 'expects PATCH requests to be disallowed' do
+      response = request.patch('/test_request')
+
+      expect(response).to be_a_redirect
+      expect(subject).to disallow_request
+    end
+
+    it 'expects PUT requests to be disallowed' do
+      response = request.put('/test_request')
+
+      expect(response).to be_a_redirect
+      expect(subject).to disallow_request
+    end
+
+    it 'expects POST requests to be disallowed' do
+      response = request.post('/test_request')
+
+      expect(response).to be_a_redirect
+      expect(subject).to disallow_request
+    end
+
+    it 'expects a internal POST request to be allowed after a disallowed request' do
+      response = request.post('/test_request')
+
+      expect(response).to be_a_redirect
+
+      response = request.post("/api/#{API::API.version}/internal")
+
+      expect(response).not_to be_a_redirect
+    end
+
+    it 'expects DELETE requests to be disallowed' do
+      response = request.delete('/test_request')
+
+      expect(response).to be_a_redirect
+      expect(subject).to disallow_request
+    end
+
+    context 'whitelisted requests' do
+      it 'expects DELETE request to logout to be allowed' do
+        response = request.delete('/users/sign_out')
+
+        expect(response).not_to be_a_redirect
+        expect(subject).not_to disallow_request
+      end
+
+      it 'expects a POST internal request to be allowed' do
+        response = request.post("/api/#{API::API.version}/internal")
+
+        expect(response).not_to be_a_redirect
+        expect(subject).not_to disallow_request
+      end
+
+      it 'expects a POST LFS request to batch URL to be allowed' do
+        response = request.post('/root/rouge.git/info/lfs/objects/batch')
+
+        expect(response).not_to be_a_redirect
+        expect(subject).not_to disallow_request
+      end
+    end
+  end
+
+  context 'json requests to a read-only GitLab instance' do
+    let(:fake_app) { lambda { |env| [200, { 'Content-Type' => 'application/json' }, ['OK']] } }
+    let(:content_json) { { 'CONTENT_TYPE' => 'application/json' } }
+
+    before do
+      allow(Gitlab::Database).to receive(:read_only?) { true }
+    end
+
+    it 'expects PATCH requests to be disallowed' do
+      response = request.patch('/test_request', content_json)
+
+      expect(response).to disallow_request_in_json
+    end
+
+    it 'expects PUT requests to be disallowed' do
+      response = request.put('/test_request', content_json)
+
+      expect(response).to disallow_request_in_json
+    end
+
+    it 'expects POST requests to be disallowed' do
+      response = request.post('/test_request', content_json)
+
+      expect(response).to disallow_request_in_json
+    end
+
+    it 'expects DELETE requests to be disallowed' do
+      response = request.delete('/test_request', content_json)
+
+      expect(response).to disallow_request_in_json
+    end
+  end
+end
diff --git a/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb b/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
index a0fb86345f3..b4b83b70d1c 100644
--- a/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
+++ b/spec/lib/system_check/app/git_user_default_ssh_config_check_spec.rb
@@ -39,6 +39,14 @@ describe SystemCheck::App::GitUserDefaultSSHConfigCheck do
 
       it { is_expected.to eq(expected_result) }
     end
+
+    it 'skips GitLab read-only instances' do
+      stub_user
+      stub_home_dir
+      allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+
+      is_expected.to be_truthy
+    end
   end
 
   describe '#check?' do
diff --git a/spec/models/concerns/cache_markdown_field_spec.rb b/spec/models/concerns/cache_markdown_field_spec.rb
index 40bbb10eaac..129dfa07f15 100644
--- a/spec/models/concerns/cache_markdown_field_spec.rb
+++ b/spec/models/concerns/cache_markdown_field_spec.rb
@@ -178,57 +178,59 @@ describe CacheMarkdownField do
     end
   end
 
-  describe '#refresh_markdown_cache!' do
+  describe '#refresh_markdown_cache' do
     before do
       thing.foo = updated_markdown
     end
 
-    context 'do_update: false' do
-      it 'fills all html fields' do
-        thing.refresh_markdown_cache!
+    it 'fills all html fields' do
+      thing.refresh_markdown_cache
 
-        expect(thing.foo_html).to eq(updated_html)
-        expect(thing.foo_html_changed?).to be_truthy
-        expect(thing.baz_html_changed?).to be_truthy
-      end
+      expect(thing.foo_html).to eq(updated_html)
+      expect(thing.foo_html_changed?).to be_truthy
+      expect(thing.baz_html_changed?).to be_truthy
+    end
 
-      it 'does not save the result' do
-        expect(thing).not_to receive(:update_columns)
+    it 'does not save the result' do
+      expect(thing).not_to receive(:update_columns)
 
-        thing.refresh_markdown_cache!
-      end
+      thing.refresh_markdown_cache
+    end
 
-      it 'updates the markdown cache version' do
-        thing.cached_markdown_version = nil
-        thing.refresh_markdown_cache!
+    it 'updates the markdown cache version' do
+      thing.cached_markdown_version = nil
+      thing.refresh_markdown_cache
 
-        expect(thing.cached_markdown_version).to eq(CacheMarkdownField::CACHE_VERSION)
-      end
+      expect(thing.cached_markdown_version).to eq(CacheMarkdownField::CACHE_VERSION)
     end
+  end
 
-    context 'do_update: true' do
-      it 'fills all html fields' do
-        thing.refresh_markdown_cache!(do_update: true)
+  describe '#refresh_markdown_cache!' do
+    before do
+      thing.foo = updated_markdown
+    end
 
-        expect(thing.foo_html).to eq(updated_html)
-        expect(thing.foo_html_changed?).to be_truthy
-        expect(thing.baz_html_changed?).to be_truthy
-      end
+    it 'fills all html fields' do
+      thing.refresh_markdown_cache!
 
-      it 'skips saving if not persisted' do
-        expect(thing).to receive(:persisted?).and_return(false)
-        expect(thing).not_to receive(:update_columns)
+      expect(thing.foo_html).to eq(updated_html)
+      expect(thing.foo_html_changed?).to be_truthy
+      expect(thing.baz_html_changed?).to be_truthy
+    end
 
-        thing.refresh_markdown_cache!(do_update: true)
-      end
+    it 'skips saving if not persisted' do
+      expect(thing).to receive(:persisted?).and_return(false)
+      expect(thing).not_to receive(:update_columns)
 
-      it 'saves the changes using #update_columns' do
-        expect(thing).to receive(:persisted?).and_return(true)
-        expect(thing).to receive(:update_columns)
-          .with("foo_html" => updated_html, "baz_html" => "", "cached_markdown_version" => CacheMarkdownField::CACHE_VERSION)
+      thing.refresh_markdown_cache!
+    end
 
-        thing.refresh_markdown_cache!(do_update: true)
-      end
+    it 'saves the changes using #update_columns' do
+      expect(thing).to receive(:persisted?).and_return(true)
+      expect(thing).to receive(:update_columns)
+        .with("foo_html" => updated_html, "baz_html" => "", "cached_markdown_version" => CacheMarkdownField::CACHE_VERSION)
+
+      thing.refresh_markdown_cache!
     end
   end
 
diff --git a/spec/models/concerns/routable_spec.rb b/spec/models/concerns/routable_spec.rb
index b463d12e448..ab8773b7ede 100644
--- a/spec/models/concerns/routable_spec.rb
+++ b/spec/models/concerns/routable_spec.rb
@@ -12,6 +12,16 @@ describe Group, 'Routable' do
     it { is_expected.to have_many(:redirect_routes).dependent(:destroy) }
   end
 
+  describe 'GitLab read-only instance' do
+    it 'does not save route if route is not present' do
+      group.route.path = ''
+      allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+      expect(group).to receive(:update_route).and_call_original
+
+      expect { group.full_path }.to change { Route.count }.by(0)
+    end
+  end
+
   describe 'Callbacks' do
     it 'creates route record on create' do
       expect(group.route.path).to eq(group.path)
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 9b470e79a76..ec700215521 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -692,6 +692,44 @@ describe Project do
         project.cache_has_external_issue_tracker
       end.to change { project.has_external_issue_tracker}.to(false)
     end
+
+    it 'does not cache data when in a read-only GitLab instance' do
+      allow(Gitlab::Database).to receive(:read_only?) { true }
+
+      expect do
+        project.cache_has_external_issue_tracker
+      end.not_to change { project.has_external_issue_tracker }
+    end
+  end
+
+  describe '#cache_has_external_wiki' do
+    let(:project) { create(:project, has_external_wiki: nil) }
+
+    it 'stores true if there is any external_wikis' do
+      services = double(:service, external_wikis: [ExternalWikiService.new])
+      expect(project).to receive(:services).and_return(services)
+
+      expect do
+        project.cache_has_external_wiki
+      end.to change { project.has_external_wiki}.to(true)
+    end
+
+    it 'stores false if there is no external_wikis' do
+      services = double(:service, external_wikis: [])
+      expect(project).to receive(:services).and_return(services)
+
+      expect do
+        project.cache_has_external_wiki
+      end.to change { project.has_external_wiki}.to(false)
+    end
+
+    it 'does not cache data when in a read-only GitLab instance' do
+      allow(Gitlab::Database).to receive(:read_only?) { true }
+
+      expect do
+        project.cache_has_external_wiki
+      end.not_to change { project.has_external_wiki }
+    end
   end
 
   describe '#has_wiki?' do
@@ -2446,7 +2484,7 @@ describe Project do
         expect(project.migrate_to_hashed_storage!).to be_truthy
       end
 
-      it 'flags as readonly' do
+      it 'flags as read-only' do
         expect { project.migrate_to_hashed_storage! }.to change { project.repository_read_only }.to(true)
       end
 
@@ -2573,7 +2611,7 @@ describe Project do
         expect(project.migrate_to_hashed_storage!).to be_nil
       end
 
-      it 'does not flag as readonly' do
+      it 'does not flag as read-only' do
         expect { project.migrate_to_hashed_storage! }.not_to change { project.repository_read_only }
       end
     end
diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb
index 27d09b8202e..eb4017e116b 100644
--- a/spec/requests/lfs_http_spec.rb
+++ b/spec/requests/lfs_http_spec.rb
@@ -824,6 +824,34 @@ describe 'Git LFS API and storage' do
     end
   end
 
+  describe 'when handling lfs batch request on a read-only GitLab instance' do
+    let(:authorization) { authorize_user }
+    let(:project) { create(:project) }
+    let(:path) { "#{project.http_url_to_repo}/info/lfs/objects/batch" }
+    let(:body) do
+      { 'objects' => [{ 'oid' => sample_oid, 'size' => sample_size }] }
+    end
+
+    before do
+      allow(Gitlab::Database).to receive(:read_only?) { true }
+      project.team << [user, :master]
+      enable_lfs
+    end
+
+    it 'responds with a 200 message on download' do
+      post_lfs_json path, body.merge('operation' => 'download'), headers
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'responds with a 403 message on upload' do
+      post_lfs_json path, body.merge('operation' => 'upload'), headers
+
+      expect(response).to have_gitlab_http_status(403)
+      expect(json_response).to include('message' => 'You cannot write to this read-only GitLab instance.')
+    end
+  end
+
   describe 'when pushing a lfs object' do
     before do
       enable_lfs
diff --git a/spec/services/projects/hashed_storage_migration_service_spec.rb b/spec/services/projects/hashed_storage_migration_service_spec.rb
index 1b61207b550..aa1988d29d6 100644
--- a/spec/services/projects/hashed_storage_migration_service_spec.rb
+++ b/spec/services/projects/hashed_storage_migration_service_spec.rb
@@ -20,7 +20,7 @@ describe Projects::HashedStorageMigrationService do
         expect(gitlab_shell.exists?(project.repository_storage_path, "#{hashed_storage.disk_path}.wiki.git")).to be_truthy
       end
 
-      it 'updates project to be hashed and not readonly' do
+      it 'updates project to be hashed and not read-only' do
         service.execute
 
         expect(project.hashed_storage?).to be_truthy
diff --git a/spec/services/users/activity_service_spec.rb b/spec/services/users/activity_service_spec.rb
index fef4da0c76e..17eabad73be 100644
--- a/spec/services/users/activity_service_spec.rb
+++ b/spec/services/users/activity_service_spec.rb
@@ -38,6 +38,18 @@ describe Users::ActivityService do
         end
       end
     end
+
+    context 'when in GitLab read-only instance' do
+      before do
+        allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+      end
+
+      it 'does not update last_activity_at' do
+        service.execute
+
+        expect(last_hour_user_ids).to eq([])
+      end
+    end
   end
 
   def last_hour_user_ids
-- 
cgit v1.2.1


From 265b1a3b72ff7552e2ae01a059f80bd59714649d Mon Sep 17 00:00:00 2001
From: Winnie Hellmann <winnie@gitlab.com>
Date: Fri, 6 Oct 2017 20:40:41 +0000
Subject: Show confirmation modal before deleting account

---
 app/assets/javascripts/lib/utils/csrf.js           |   4 +-
 .../account/components/delete_account_modal.vue    | 146 +++++++++++++++++++++
 app/assets/javascripts/profile/account/index.js    |  21 +++
 app/assets/javascripts/repo/components/repo.vue    |   2 +-
 .../vue_shared/components/popup_dialog.vue         |   6 +-
 app/assets/stylesheets/framework/modal.scss        |  13 +-
 app/assets/stylesheets/framework/variables.scss    |   1 +
 app/controllers/registrations_controller.rb        |  29 +++-
 app/models/user.rb                                 |   4 +
 app/views/profiles/accounts/show.html.haml         |  20 ++-
 .../unreleased/winh-delete-account-modal.yml       |   5 +
 config/webpack.config.js                           |   1 +
 spec/controllers/registrations_controller_spec.rb  |  64 ++++++++-
 spec/features/issues/issue_detail_spec.rb          |   3 +-
 spec/features/profile_spec.rb                      |  44 ++++++-
 .../components/delete_account_modal_spec.js        | 129 ++++++++++++++++++
 spec/models/user_spec.rb                           |  45 +++++++
 17 files changed, 507 insertions(+), 30 deletions(-)
 create mode 100644 app/assets/javascripts/profile/account/components/delete_account_modal.vue
 create mode 100644 app/assets/javascripts/profile/account/index.js
 create mode 100644 changelogs/unreleased/winh-delete-account-modal.yml
 create mode 100644 spec/javascripts/profile/account/components/delete_account_modal_spec.js

diff --git a/app/assets/javascripts/lib/utils/csrf.js b/app/assets/javascripts/lib/utils/csrf.js
index ae41cc5e8a8..0bdb547d31a 100644
--- a/app/assets/javascripts/lib/utils/csrf.js
+++ b/app/assets/javascripts/lib/utils/csrf.js
@@ -14,6 +14,9 @@ If you need to compose a headers object, use the spread operator:
     someOtherHeader: '12345',
   }
 ```
+
+see also http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf
+and https://github.com/rails/jquery-rails/blob/v4.3.1/vendor/assets/javascripts/jquery_ujs.js#L59-L62
  */
 
 const csrf = {
@@ -53,4 +56,3 @@ if ($.rails) {
 }
 
 export default csrf;
-
diff --git a/app/assets/javascripts/profile/account/components/delete_account_modal.vue b/app/assets/javascripts/profile/account/components/delete_account_modal.vue
new file mode 100644
index 00000000000..b2b34cb83e1
--- /dev/null
+++ b/app/assets/javascripts/profile/account/components/delete_account_modal.vue
@@ -0,0 +1,146 @@
+<script>
+  import popupDialog from '../../../vue_shared/components/popup_dialog.vue';
+  import { __, s__, sprintf } from '../../../locale';
+  import csrf from '../../../lib/utils/csrf';
+
+  export default {
+    props: {
+      actionUrl: {
+        type: String,
+        required: true,
+      },
+      confirmWithPassword: {
+        type: Boolean,
+        required: true,
+      },
+      username: {
+        type: String,
+        required: true,
+      },
+    },
+    data() {
+      return {
+        enteredPassword: '',
+        enteredUsername: '',
+        isOpen: false,
+      };
+    },
+    components: {
+      popupDialog,
+    },
+    computed: {
+      csrfToken() {
+        return csrf.token;
+      },
+      inputLabel() {
+        let confirmationValue;
+        if (this.confirmWithPassword) {
+          confirmationValue = __('password');
+        } else {
+          confirmationValue = __('username');
+        }
+
+        confirmationValue = `<code>${confirmationValue}</code>`;
+
+        return sprintf(
+          s__('Profiles|Type your %{confirmationValue} to confirm:'),
+          { confirmationValue },
+          false,
+        );
+      },
+      text() {
+        return sprintf(
+          s__(`Profiles|
+You are about to permanently delete %{yourAccount}, and all of the issues, merge requests, and groups linked to your account.
+Once you confirm %{deleteAccount}, it cannot be undone or recovered.`),
+          {
+            yourAccount: `<strong>${s__('Profiles|your account')}</strong>`,
+            deleteAccount: `<strong>${s__('Profiles|Delete Account')}</strong>`,
+          },
+          false,
+        );
+      },
+    },
+    methods: {
+      canSubmit() {
+        if (this.confirmWithPassword) {
+          return this.enteredPassword !== '';
+        }
+
+        return this.enteredUsername === this.username;
+      },
+      onSubmit(status) {
+        if (status) {
+          if (!this.canSubmit()) {
+            return;
+          }
+
+          this.$refs.form.submit();
+        }
+
+        this.toggleOpen(false);
+      },
+      toggleOpen(isOpen) {
+        this.isOpen = isOpen;
+      },
+    },
+  };
+</script>
+
+<template>
+  <div>
+    <popup-dialog
+      v-if="isOpen"
+      :title="s__('Profiles|Delete your account?')"
+      :text="text"
+      :kind="`danger ${!canSubmit() && 'disabled'}`"
+      :primary-button-label="s__('Profiles|Delete account')"
+      @toggle="toggleOpen"
+      @submit="onSubmit">
+
+      <template slot="body" scope="props">
+        <p v-html="props.text"></p>
+
+        <form
+          ref="form"
+          :action="actionUrl"
+          method="post">
+
+          <input
+            type="hidden"
+            name="_method"
+            value="delete" />
+          <input
+            type="hidden"
+            name="authenticity_token"
+            :value="csrfToken" />
+
+          <p id="input-label" v-html="inputLabel"></p>
+
+          <input
+            v-if="confirmWithPassword"
+            name="password"
+            class="form-control"
+            type="password"
+            v-model="enteredPassword"
+            aria-labelledby="input-label" />
+          <input
+            v-else
+            name="username"
+            class="form-control"
+            type="text"
+            v-model="enteredUsername"
+            aria-labelledby="input-label" />
+        </form>
+      </template>
+
+    </popup-dialog>
+
+    <button
+      type="button"
+      class="btn btn-danger"
+      @click="toggleOpen(true)">
+      {{ s__('Profiles|Delete account') }}
+    </button>
+  </div>
+</template>
diff --git a/app/assets/javascripts/profile/account/index.js b/app/assets/javascripts/profile/account/index.js
new file mode 100644
index 00000000000..635056e0eeb
--- /dev/null
+++ b/app/assets/javascripts/profile/account/index.js
@@ -0,0 +1,21 @@
+import Vue from 'vue';
+
+import deleteAccountModal from './components/delete_account_modal.vue';
+
+const deleteAccountModalEl = document.getElementById('delete-account-modal');
+// eslint-disable-next-line no-new
+new Vue({
+  el: deleteAccountModalEl,
+  components: {
+    deleteAccountModal,
+  },
+  render(createElement) {
+    return createElement('delete-account-modal', {
+      props: {
+        actionUrl: deleteAccountModalEl.dataset.actionUrl,
+        confirmWithPassword: !!deleteAccountModalEl.dataset.confirmWithPassword,
+        username: deleteAccountModalEl.dataset.username,
+      },
+    });
+  },
+});
diff --git a/app/assets/javascripts/repo/components/repo.vue b/app/assets/javascripts/repo/components/repo.vue
index d6c864cb976..cc60aa5939c 100644
--- a/app/assets/javascripts/repo/components/repo.vue
+++ b/app/assets/javascripts/repo/components/repo.vue
@@ -62,7 +62,7 @@ export default {
       :primary-button-label="__('Discard changes')"
       kind="warning"
       :title="__('Are you sure?')"
-      :body="__('Are you sure you want to discard your changes?')"
+      :text="__('Are you sure you want to discard your changes?')"
       @toggle="toggleDialogOpen"
       @submit="dialogSubmitted"
     />
diff --git a/app/assets/javascripts/vue_shared/components/popup_dialog.vue b/app/assets/javascripts/vue_shared/components/popup_dialog.vue
index 994b33bc1c9..9279b50cd55 100644
--- a/app/assets/javascripts/vue_shared/components/popup_dialog.vue
+++ b/app/assets/javascripts/vue_shared/components/popup_dialog.vue
@@ -7,7 +7,7 @@ export default {
       type: String,
       required: true,
     },
-    body: {
+    text: {
       type: String,
       required: true,
     },
@@ -63,7 +63,9 @@ export default {
         <h4 class="modal-title">{{this.title}}</h4>
       </div>
       <div class="modal-body">
-        <p>{{this.body}}</p>
+        <slot name="body" :text="text">
+          <p>{{text}}</p>
+        </slot>
       </div>
       <div class="modal-footer">
         <button
diff --git a/app/assets/stylesheets/framework/modal.scss b/app/assets/stylesheets/framework/modal.scss
index 5b581780447..1cebd02df48 100644
--- a/app/assets/stylesheets/framework/modal.scss
+++ b/app/assets/stylesheets/framework/modal.scss
@@ -1,10 +1,17 @@
+.modal-header {
+  padding: #{3 * $grid-size} #{2 * $grid-size};
+
+  .page-title {
+    margin-top: 0;
+  }
+}
+
 .modal-body {
   position: relative;
-  padding: 15px;
+  padding: #{3 * $grid-size} #{2 * $grid-size};
 
   .form-actions {
-    margin: -$gl-padding + 1;
-    margin-top: 15px;
+    margin: #{2 * $grid-size} #{-2 * $grid-size} #{-2 * $grid-size};
   }
 
   .text-danger {
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 5ab40947da9..2f9def51d91 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -1,6 +1,7 @@
 /*
  * Layout
  */
+$grid-size: 8px;
 $gutter_collapsed_width: 62px;
 $gutter_width: 290px;
 $gutter_inner_width: 250px;
diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 5ea3a5d5562..d9142311b6f 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -25,18 +25,33 @@ class RegistrationsController < Devise::RegistrationsController
   end
 
   def destroy
-    current_user.delete_async(deleted_by: current_user)
-
-    respond_to do |format|
-      format.html do
-        session.try(:destroy)
-        redirect_to new_user_session_path, status: 302, notice: "Account scheduled for removal."
-      end
+    if destroy_confirmation_valid?
+      current_user.delete_async(deleted_by: current_user)
+      session.try(:destroy)
+      redirect_to new_user_session_path, status: 303, notice: s_('Profiles|Account scheduled for removal.')
+    else
+      redirect_to profile_account_path, status: 303, alert: destroy_confirmation_failure_message
     end
   end
 
   protected
 
+  def destroy_confirmation_valid?
+    if current_user.confirm_deletion_with_password?
+      current_user.valid_password?(params[:password])
+    else
+      current_user.username == params[:username]
+    end
+  end
+
+  def destroy_confirmation_failure_message
+    if current_user.confirm_deletion_with_password?
+      s_('Profiles|Invalid password')
+    else
+      s_('Profiles|Invalid username')
+    end
+  end
+
   def build_resource(hash = nil)
     super
   end
diff --git a/app/models/user.rb b/app/models/user.rb
index 4ba9130a75a..959738ba608 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -654,6 +654,10 @@ class User < ActiveRecord::Base
     Ability.allowed?(self, action, subject)
   end
 
+  def confirm_deletion_with_password?
+    !password_automatically_set? && allow_password_authentication?
+  end
+
   def first_name
     name.split.first unless name.blank?
   end
diff --git a/app/views/profiles/accounts/show.html.haml b/app/views/profiles/accounts/show.html.haml
index 8abbd828032..7f79168dfb3 100644
--- a/app/views/profiles/accounts/show.html.haml
+++ b/app/views/profiles/accounts/show.html.haml
@@ -97,21 +97,29 @@
 .row.prepend-top-default
   .col-lg-4.profile-settings-sidebar
     %h4.prepend-top-0.danger-title
-      Remove account
+      = s_('Profiles|Delete account')
   .col-lg-8
     - if @user.can_be_removed? && can?(current_user, :destroy_user, @user)
       %p
-        Deleting an account has the following effects:
+        = s_('Profiles|Deleting an account has the following effects:')
       = render 'users/deletion_guidance', user: current_user
-      = link_to 'Delete account', user_registration_path, data: { confirm: "REMOVE #{current_user.name}? Are you sure?" }, method: :delete, class: "btn btn-remove"
+
+      #delete-account-modal{ data: { action_url: user_registration_path,
+        confirm_with_password: ('true' if current_user.confirm_deletion_with_password?),
+        username: current_user.username } }
+        %button.btn.btn-danger.disabled
+          = s_('Profiles|Delete account')
     - else
       - if @user.solo_owned_groups.present?
         %p
-          Your account is currently an owner in these groups:
+          = s_('Profiles|Your account is currently an owner in these groups:')
           %strong= @user.solo_owned_groups.map(&:name).join(', ')
         %p
-          You must transfer ownership or delete these groups before you can delete your account.
+          = s_('Profiles|You must transfer ownership or delete these groups before you can delete your account.')
       - else
         %p
-          You don't have access to delete this user.
+          = s_("Profiles|You don't have access to delete this user.")
 .append-bottom-default
+
+- content_for :page_specific_javascripts do
+  = webpack_bundle_tag('account')
diff --git a/changelogs/unreleased/winh-delete-account-modal.yml b/changelogs/unreleased/winh-delete-account-modal.yml
new file mode 100644
index 00000000000..f1e2710fdcc
--- /dev/null
+++ b/changelogs/unreleased/winh-delete-account-modal.yml
@@ -0,0 +1,5 @@
+---
+title: Show confirmation modal before deleting account
+merge_request: 14360
+author:
+type: changed
diff --git a/config/webpack.config.js b/config/webpack.config.js
index c515a170d2d..8cded750a66 100644
--- a/config/webpack.config.js
+++ b/config/webpack.config.js
@@ -26,6 +26,7 @@ var config = {
   },
   context: path.join(ROOT_PATH, 'app/assets/javascripts'),
   entry: {
+    account:              './profile/account/index.js',
     balsamiq_viewer:      './blob/balsamiq_viewer.js',
     blob:                 './blob_edit/blob_bundle.js',
     boards:               './boards/boards_bundle.js',
diff --git a/spec/controllers/registrations_controller_spec.rb b/spec/controllers/registrations_controller_spec.rb
index 5a4ab39ab86..1d3ddfbd220 100644
--- a/spec/controllers/registrations_controller_spec.rb
+++ b/spec/controllers/registrations_controller_spec.rb
@@ -76,12 +76,68 @@ describe RegistrationsController do
       sign_in(user)
     end
 
-    it 'schedules the user for destruction' do
-      expect(DeleteUserWorker).to receive(:perform_async).with(user.id, user.id, {})
+    def expect_failure(message)
+      expect(flash[:alert]).to eq(message)
+      expect(response.status).to eq(303)
+      expect(response).to redirect_to profile_account_path
+    end
+
+    def expect_password_failure
+      expect_failure('Invalid password')
+    end
+
+    def expect_username_failure
+      expect_failure('Invalid username')
+    end
+
+    def expect_success
+      expect(flash[:notice]).to eq 'Account scheduled for removal.'
+      expect(response.status).to eq(303)
+      expect(response).to redirect_to new_user_session_path
+    end
 
-      post(:destroy)
+    context 'user requires password confirmation' do
+      it 'fails if password confirmation is not provided' do
+        post :destroy
 
-      expect(response.status).to eq(302)
+        expect_password_failure
+      end
+
+      it 'fails if password confirmation is wrong' do
+        post :destroy, password: 'wrong password'
+
+        expect_password_failure
+      end
+
+      it 'succeeds if password is confirmed' do
+        post :destroy, password: '12345678'
+
+        expect_success
+      end
+    end
+
+    context 'user does not require password confirmation' do
+      before do
+        stub_application_setting(password_authentication_enabled: false)
+      end
+
+      it 'fails if username confirmation is not provided' do
+        post :destroy
+
+        expect_username_failure
+      end
+
+      it 'fails if username confirmation is wrong' do
+        post :destroy, username: 'wrong username'
+
+        expect_username_failure
+      end
+
+      it 'succeeds if username is confirmed' do
+        post :destroy, username: user.username
+
+        expect_success
+      end
     end
   end
 end
diff --git a/spec/features/issues/issue_detail_spec.rb b/spec/features/issues/issue_detail_spec.rb
index 28b636f9359..c0c396af93f 100644
--- a/spec/features/issues/issue_detail_spec.rb
+++ b/spec/features/issues/issue_detail_spec.rb
@@ -28,8 +28,7 @@ feature 'Issue Detail', :js do
       fill_in 'issue-title', with: 'issue title'
       click_button 'Save'
 
-      visit profile_account_path
-      click_link 'Delete account'
+      Users::DestroyService.new(user).execute(user)
 
       visit project_issue_path(project, issue)
     end
diff --git a/spec/features/profile_spec.rb b/spec/features/profile_spec.rb
index f183dd8cb75..1cddd35fd8a 100644
--- a/spec/features/profile_spec.rb
+++ b/spec/features/profile_spec.rb
@@ -12,11 +12,47 @@ describe 'Profile account page' do
       visit profile_account_path
     end
 
-    it { expect(page).to have_content('Remove account') }
+    it { expect(page).to have_content('Delete account') }
 
-    it 'deletes the account' do
-      expect { click_link 'Delete account' }.to change { User.where(id: user.id).count }.by(-1)
-      expect(current_path).to eq(new_user_session_path)
+    it 'does not immediately delete the account' do
+      click_button 'Delete account'
+
+      expect(User.exists?(user.id)).to be_truthy
+    end
+
+    it 'deletes user', :js do
+      click_button 'Delete account'
+
+      fill_in 'password', with: '12345678'
+
+      page.within '.popup-dialog' do
+        click_button 'Delete account'
+      end
+
+      expect(page).to have_content('Account scheduled for removal')
+      expect(User.exists?(user.id)).to be_falsy
+    end
+
+    it 'shows invalid password flash message', :js do
+      click_button 'Delete account'
+
+      fill_in 'password', with: 'testing123'
+
+      page.within '.popup-dialog' do
+        click_button 'Delete account'
+      end
+
+      expect(page).to have_content('Invalid password')
+    end
+
+    it 'does not show delete button when user owns a group' do
+      group = create(:group)
+      group.add_owner(user)
+
+      visit profile_account_path
+
+      expect(page).not_to have_button('Delete account')
+      expect(page).to have_content("Your account is currently an owner in these groups: #{group.name}")
     end
   end
 
diff --git a/spec/javascripts/profile/account/components/delete_account_modal_spec.js b/spec/javascripts/profile/account/components/delete_account_modal_spec.js
new file mode 100644
index 00000000000..2e94948cfb2
--- /dev/null
+++ b/spec/javascripts/profile/account/components/delete_account_modal_spec.js
@@ -0,0 +1,129 @@
+import Vue from 'vue';
+
+import deleteAccountModal from '~/profile/account/components/delete_account_modal.vue';
+
+import mountComponent from '../../../helpers/vue_mount_component_helper';
+
+describe('DeleteAccountModal component', () => {
+  const actionUrl = `${gl.TEST_HOST}/delete/user`;
+  const username = 'hasnoname';
+  let Component;
+  let vm;
+
+  beforeEach(() => {
+    Component = Vue.extend(deleteAccountModal);
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  const findElements = () => {
+    const confirmation = vm.confirmWithPassword ? 'password' : 'username';
+    return {
+      form: vm.$refs.form,
+      input: vm.$el.querySelector(`[name="${confirmation}"]`),
+      submitButton: vm.$el.querySelector('.btn-danger'),
+    };
+  };
+
+  describe('with password confirmation', () => {
+    beforeEach((done) => {
+      vm = mountComponent(Component, {
+        actionUrl,
+        confirmWithPassword: true,
+        username,
+      });
+
+      vm.isOpen = true;
+
+      Vue.nextTick()
+        .then(done)
+        .catch(done.fail);
+    });
+
+    it('does not accept empty password', (done) => {
+      const { form, input, submitButton } = findElements();
+      spyOn(form, 'submit');
+      input.value = '';
+      input.dispatchEvent(new Event('input'));
+
+      Vue.nextTick()
+        .then(() => {
+          expect(vm.enteredPassword).toBe(input.value);
+          expect(submitButton).toHaveClass('disabled');
+          submitButton.click();
+          expect(form.submit).not.toHaveBeenCalled();
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+
+    it('submits form with password', (done) => {
+      const { form, input, submitButton } = findElements();
+      spyOn(form, 'submit');
+      input.value = 'anything';
+      input.dispatchEvent(new Event('input'));
+
+      Vue.nextTick()
+        .then(() => {
+          expect(vm.enteredPassword).toBe(input.value);
+          expect(submitButton).not.toHaveClass('disabled');
+          submitButton.click();
+          expect(form.submit).toHaveBeenCalled();
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+  });
+
+  describe('with username confirmation', () => {
+    beforeEach((done) => {
+      vm = mountComponent(Component, {
+        actionUrl,
+        confirmWithPassword: false,
+        username,
+      });
+
+      vm.isOpen = true;
+
+      Vue.nextTick()
+        .then(done)
+        .catch(done.fail);
+    });
+
+    it('does not accept wrong username', (done) => {
+      const { form, input, submitButton } = findElements();
+      spyOn(form, 'submit');
+      input.value = 'this is wrong';
+      input.dispatchEvent(new Event('input'));
+
+      Vue.nextTick()
+        .then(() => {
+          expect(vm.enteredUsername).toBe(input.value);
+          expect(submitButton).toHaveClass('disabled');
+          submitButton.click();
+          expect(form.submit).not.toHaveBeenCalled();
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+
+    it('submits form with correct username', (done) => {
+      const { form, input, submitButton } = findElements();
+      spyOn(form, 'submit');
+      input.value = username;
+      input.dispatchEvent(new Event('input'));
+
+      Vue.nextTick()
+        .then(() => {
+          expect(vm.enteredUsername).toBe(input.value);
+          expect(submitButton).not.toHaveClass('disabled');
+          submitButton.click();
+          expect(form.submit).toHaveBeenCalled();
+        })
+        .then(done)
+        .catch(done.fail);
+    });
+  });
+});
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 9f517e4af72..995211845ce 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -2282,4 +2282,49 @@ describe User do
       end
     end
   end
+
+  describe '#confirm_deletion_with_password?' do
+    where(
+      password_automatically_set: [true, false],
+      ldap_user: [true, false],
+      password_authentication_disabled: [true, false]
+    )
+
+    with_them do
+      let!(:user) { create(:user, password_automatically_set: password_automatically_set) }
+      let!(:identity) { create(:identity, user: user) if ldap_user }
+
+      # Only confirm deletion with password if all inputs are false
+      let(:expected) { !(password_automatically_set || ldap_user || password_authentication_disabled) }
+
+      before do
+        stub_application_setting(password_authentication_enabled: !password_authentication_disabled)
+      end
+
+      it 'returns false unless all inputs are true' do
+        expect(user.confirm_deletion_with_password?).to eq(expected)
+      end
+    end
+  end
+
+  describe '#delete_async' do
+    let(:user) { create(:user) }
+    let(:deleted_by) { create(:user) }
+
+    it 'blocks the user then schedules them for deletion if a hard delete is specified' do
+      expect(DeleteUserWorker).to receive(:perform_async).with(deleted_by.id, user.id, hard_delete: true)
+
+      user.delete_async(deleted_by: deleted_by, params: { hard_delete: true })
+
+      expect(user).to be_blocked
+    end
+
+    it 'schedules user for deletion without blocking them' do
+      expect(DeleteUserWorker).to receive(:perform_async).with(deleted_by.id, user.id, {})
+
+      user.delete_async(deleted_by: deleted_by)
+
+      expect(user).not_to be_blocked
+    end
+  end
 end
-- 
cgit v1.2.1


From 39fc2d9c25b9f7e41d20ba623ab05a5dd8adb0b0 Mon Sep 17 00:00:00 2001
From: Mike Greiling <mike@pixelcog.com>
Date: Fri, 6 Oct 2017 15:50:44 -0500
Subject: add CHANGELOG.md entry for !14741

---
 ...rics-that-do-not-have-a-complete-history-are-not-shown-at-all.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/36255-metrics-that-do-not-have-a-complete-history-are-not-shown-at-all.yml

diff --git a/changelogs/unreleased/36255-metrics-that-do-not-have-a-complete-history-are-not-shown-at-all.yml b/changelogs/unreleased/36255-metrics-that-do-not-have-a-complete-history-are-not-shown-at-all.yml
new file mode 100644
index 00000000000..a820ecee7d2
--- /dev/null
+++ b/changelogs/unreleased/36255-metrics-that-do-not-have-a-complete-history-are-not-shown-at-all.yml
@@ -0,0 +1,5 @@
+---
+title: Allow prometheus graphs to correctly handle NaN values
+merge_request: 14741
+author:
+type: fixed
-- 
cgit v1.2.1


From 26b66e58ca4179ab8720f48c72e75aa3bac05911 Mon Sep 17 00:00:00 2001
From: Jose Ivan Vargas <jvargas@gitlab.com>
Date: Fri, 6 Oct 2017 17:04:45 -0500
Subject: backport protected_branches_spec improvements from EE

---
 spec/features/protected_branches_spec.rb | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/spec/features/protected_branches_spec.rb b/spec/features/protected_branches_spec.rb
index aaf3d6d28ca..2ab1eda90f1 100644
--- a/spec/features/protected_branches_spec.rb
+++ b/spec/features/protected_branches_spec.rb
@@ -64,16 +64,24 @@ feature 'Protected Branches', :js do
     describe "Saved defaults" do
       it "keeps the allowed to merge and push dropdowns defaults based on the previous selection" do
         visit project_protected_branches_path(project)
-        find(".js-allowed-to-merge").trigger('click')
-        click_link 'No one'
-        find(".js-allowed-to-push").trigger('click')
-        click_link 'Developers + Masters'
-        visit project_protected_branches_path(project)
-        page.within(".js-allowed-to-merge") do
-          expect(page.find(".dropdown-toggle-text")).to have_content("No one")
+        form = '.js-new-protected-branch'
+
+        within form do
+          find(".js-allowed-to-merge").trigger('click')
+          click_link 'No one'
+          find(".js-allowed-to-push").trigger('click')
+          click_link 'Developers + Masters'
         end
-        page.within(".js-allowed-to-push") do
-          expect(page.find(".dropdown-toggle-text")).to have_content("Developers + Masters")
+
+        visit project_protected_branches_path(project)
+
+        within form do
+          page.within(".js-allowed-to-merge") do
+            expect(page.find(".dropdown-toggle-text")).to have_content("No one")
+          end
+          page.within(".js-allowed-to-push") do
+            expect(page.find(".dropdown-toggle-text")).to have_content("Developers + Masters")
+          end
         end
       end
     end
-- 
cgit v1.2.1


From 7312b8708fe5e917d14c60d628829d3f79027e8f Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Fri, 6 Oct 2017 15:37:26 -0700
Subject: Finish combining nav styles

---
 app/assets/stylesheets/framework.scss         |   2 -
 app/assets/stylesheets/framework/header.scss  | 470 ++++++++++++++++++++++----
 app/assets/stylesheets/framework/images.scss  |   1 +
 app/assets/stylesheets/framework/nav.scss     |   1 -
 app/assets/stylesheets/framework/new-nav.scss | 415 -----------------------
 app/views/layouts/header/_default.html.haml   |   4 +-
 6 files changed, 414 insertions(+), 479 deletions(-)
 delete mode 100644 app/assets/stylesheets/framework/nav.scss

diff --git a/app/assets/stylesheets/framework.scss b/app/assets/stylesheets/framework.scss
index 09a29d41823..c7be94e2c8e 100644
--- a/app/assets/stylesheets/framework.scss
+++ b/app/assets/stylesheets/framework.scss
@@ -30,8 +30,6 @@
 @import "framework/media_object";
 @import "framework/mobile";
 @import "framework/modal";
-@import "framework/nav";
-@import "framework/new-nav";
 @import "framework/pagination";
 @import "framework/panels";
 @import "framework/secondary-navigation-elements";
diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index cd71d3c1dd9..4693b4a18d7 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -1,7 +1,6 @@
-/*
- *  Application Header
- *
- */
+.content-wrapper.page-with-new-nav {
+  margin-top: $header-height;
+}
 
 header {
   @include new-style-dropdown;
@@ -56,8 +55,10 @@ header {
       }
 
       .navbar-toggle {
+        right: -10px;
+        border-radius: 0;
         min-width: 45px;
-        padding: 0 $gl-padding;
+        padding: 0;
         margin-right: -7px;
         font-size: 14px;
         text-align: center;
@@ -69,6 +70,12 @@ header {
           color: currentColor;
           background-color: transparent;
         }
+
+        .more-icon,
+        .close-icon {
+          fill: $white-light;
+          margin: auto;
+        }
       }
     }
   }
@@ -87,62 +94,14 @@ header {
     }
   }
 
-  .global-dropdown {
-    position: absolute;
-    left: -10px;
-
-    .badge {
-      font-size: 11px;
-    }
-
-    li {
-      &.active a {
-        font-weight: $gl-font-weight-bold;
-      }
-    }
-  }
-
   .header-content {
     display: -webkit-flex;
     display: flex;
+    justify-content: space-between;
     position: relative;
     min-height: $header-height;
     padding-left: 0;
 
-    &.menu-expanded {
-      @media (max-width: $screen-xs-max) {
-        .header-logo,
-        .title-container {
-          display: none;
-        }
-
-        .navbar-collapse {
-          display: block;
-        }
-      }
-    }
-
-    .dropdown-menu {
-      margin-top: -5px;
-    }
-
-    .header-logo {
-      display: inline-block;
-      margin: 0 12px 0 2px;
-      position: relative;
-      top: 10px;
-      transition-duration: .3s;
-
-      svg,
-      img {
-        height: 28px;
-      }
-
-      &:hover {
-        cursor: pointer;
-      }
-    }
-
     .title-container {
       display: -webkit-flex;
       display: flex;
@@ -199,15 +158,197 @@ header {
       }
     }
 
-    .navbar-collapse {
-      flex: 0 0 auto;
-      border-top: none;
-      padding: 0;
+    .dropdown.open {
+      > a {
+        border-bottom-color: $white-light;
+      }
+    }
+
+    &.menu-expanded {
+      @media (max-width: $screen-xs-max) {
+        .title-container {
+          display: none;
+        }
+
+        .navbar-collapse {
+          display: block;
+        }
+      }
+    }
+  }
+
+  .dropdown-bold-header {
+    color: $gl-text-color-secondary;
+    font-size: 12px;
+  }
+
+  .navbar-collapse {
+    flex: 0 0 auto;
+    border-top: none;
+    padding: 0;
+
+    @media (max-width: $screen-xs-max) {
+      flex: 1 1 auto;
+    }
+
+    .nav {
+      > li:not(.hidden-xs) a {
+        @media (max-width: $screen-xs-max) {
+          margin-left: 0;
+          min-width: 100%;
+        }
+      }
+    }
+  }
+
+  .container-fluid {
 
+    .navbar-nav {
       @media (max-width: $screen-xs-max) {
-        flex: 1 1 auto;
+        display: -webkit-flex;
+        display: flex;
+        padding-right: 10px;
+      }
+
+      li {
+        .badge {
+          box-shadow: none;
+          font-weight: $gl-font-weight-bold;
+        }
+      }
+    }
+
+    .nav > li {
+      &.header-user {
+        @media (max-width: $screen-xs-max) {
+          padding-left: 10px;
+        }
+      }
+
+      > a {
+        will-change: color;
+        margin: 4px 2px;
+        padding: 6px 8px;
+        height: 32px;
+
+        @media (max-width: $screen-xs-max) {
+          padding: 0;
+        }
+
+        &.header-user-dropdown-toggle {
+          margin-left: 2px;
+
+          .header-user-avatar {
+            margin-right: 0;
+          }
+        }
+
+        &:hover,
+        &:focus {
+          text-decoration: none;
+          outline: 0;
+          opacity: 1;
+          color: $white-light;
+
+          svg {
+            fill: currentColor;
+          }
+
+          &.header-user-dropdown-toggle {
+            .header-user-avatar {
+              border-color: $white-light;
+            }
+          }
+        }
+      }
+
+      .header-new-dropdown-toggle {
+        margin-right: 0;
+      }
+
+      .impersonated-user,
+      .impersonated-user:hover {
+        margin-right: 1px;
+        background-color: $white-light;
+        border-top-right-radius: 0;
+        border-bottom-right-radius: 0;
+      }
+
+      .impersonation-btn,
+      .impersonation-btn:hover {
+        background-color: $white-light;
+        margin-left: 0;
+        border-top-left-radius: 0;
+        border-bottom-left-radius: 0;
+
+        i {
+          color: $orange-500;
+          font-size: 20px;
+        }
+      }
+
+      &.active > a,
+      &.dropdown.open > a {
+
+        svg {
+          fill: currentColor;
+        }
+      }
+    }
+  }
+}
+
+.navbar-sub-nav,
+.navbar-nav {
+  > li {
+    > a:hover,
+    > a:focus {
+      text-decoration: none;
+      outline: 0;
+      color: $white-light;
+
+      svg {
+        fill: currentColor;
+      }
+    }
+
+    > a {
+      display: -webkit-flex;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 6px 8px;
+      margin: 4px 2px;
+      font-size: 12px;
+      color: currentColor;
+      border-radius: $border-radius-default;
+      height: 32px;
+      font-weight: $gl-font-weight-bold;
+
+      svg {
+        fill: currentColor;
       }
     }
+
+    &.line-separator {
+      margin: 8px;
+    }
+  }
+}
+
+.navbar-sub-nav {
+  display: -webkit-flex;
+  display: flex;
+  margin: 0 0 0 6px;
+
+  .projects-dropdown-menu {
+    padding: 0;
+  }
+
+  .dropdown-chevron {
+    position: relative;
+    top: -1px;
+    font-size: 10px;
   }
 
   .project-item-select-holder {
@@ -218,3 +359,214 @@ header {
     color: $red-500;
   }
 }
+
+.caret-down {
+  height: 11px;
+  width: 11px;
+  margin-left: 4px;
+  fill: currentColor;
+}
+
+.header-user .dropdown-menu-nav,
+.header-new .dropdown-menu-nav {
+  margin-top: $dropdown-vertical-offset;
+}
+
+.breadcrumbs {
+  display: -webkit-flex;
+  display: flex;
+  min-height: 48px;
+  color: $gl-text-color;
+}
+
+.breadcrumbs-container {
+  display: -webkit-flex;
+  display: flex;
+  width: 100%;
+  position: relative;
+  padding-top: $gl-padding / 2;
+  padding-bottom: $gl-padding / 2;
+  align-items: center;
+  border-bottom: 1px solid $border-color;
+}
+
+.breadcrumbs-links {
+  -webkit-flex: 1;
+  flex: 1;
+  min-width: 0;
+  align-self: center;
+  color: $gl-text-color-secondary;
+
+  .avatar-tile {
+    margin-right: 4px;
+    border: 1px solid $border-color;
+    border-radius: 50%;
+    vertical-align: sub;
+  }
+
+  .text-expander {
+    margin-left: 0;
+    margin-right: 2px;
+
+    > i {
+      position: relative;
+      top: 1px;
+    }
+  }
+}
+
+.breadcrumbs-list {
+  display: -webkit-flex;
+  display: flex;
+  flex-wrap: wrap;
+  margin-bottom: 0;
+  line-height: 16px;
+
+  > li {
+    display: flex;
+    align-items: center;
+    position: relative;
+    padding: 2px 0;
+
+    &:not(:last-child) {
+      margin-right: 20px;
+    }
+
+    > a {
+      font-size: 12px;
+      color: currentColor;
+    }
+  }
+}
+
+.breadcrumb-item-text {
+  @include str-truncated(128px);
+  text-decoration: inherit;
+}
+
+.breadcrumbs-list-angle {
+  position: absolute;
+  right: -12px;
+  top: 50%;
+  color: $gl-text-color-tertiary;
+  transform: translateY(-50%);
+}
+
+.breadcrumbs-extra {
+  display: -webkit-flex;
+  display: flex;
+  flex: 0 0 auto;
+  margin-left: auto;
+}
+
+.breadcrumbs-sub-title {
+  margin: 0;
+  font-size: 12px;
+  font-weight: 600;
+  line-height: 16px;
+
+  a {
+    color: $gl-text-color;
+  }
+}
+
+.btn-sign-in {
+  margin-top: 3px;
+  font-weight: $gl-font-weight-bold;
+
+  &:hover {
+    background-color: $white-light;
+  }
+}
+
+.navbar-nav {
+  li {
+    .badge {
+      position: inherit;
+      font-weight: $gl-font-weight-normal;
+      margin-left: -6px;
+      font-size: 11px;
+      color: $white-light;
+      padding: 0 5px;
+      line-height: 12px;
+      border-radius: 7px;
+      box-shadow: 0 1px 0 rgba($gl-header-color, .2);
+
+      &.issues-count {
+        background-color: $green-500;
+      }
+
+      &.merge-requests-count {
+        background-color: $orange-600;
+      }
+
+      &.todos-count {
+        background-color: $blue-500;
+      }
+    }
+  }
+}
+
+@media (max-width: $screen-xs-max) {
+  header .container-fluid {
+    font-size: 18px;
+
+    .navbar-nav {
+      table-layout: fixed;
+      width: 100%;
+      margin: 0;
+      text-align: right;
+    }
+
+    .navbar-collapse {
+      margin-left: -8px;
+      margin-right: -10px;
+
+      .nav > li:not(.hidden-xs) {
+        display: table-cell !important;
+        width: 25%;
+
+        a {
+          margin-right: 8px;
+        }
+      }
+    }
+  }
+
+  .header-user-dropdown-toggle {
+    text-align: center;
+  }
+
+  .header-user-avatar {
+    float: none;
+  }
+}
+
+.header-user {
+  .dropdown-menu-nav {
+    width: auto;
+    min-width: 140px;
+    margin-top: 4px;
+    color: $gl-text-color;
+    left: auto;
+
+    .current-user {
+      padding: 5px 18px;
+
+      .user-name {
+        display: block;
+      }
+    }
+  }
+}
+
+.header-user-avatar {
+  float: left;
+  margin-right: 5px;
+  border-radius: 50%;
+  border: 1px solid $avatar-border;
+}
+
+.with-performance-bar header.navbar-gitlab {
+  top: $performance-bar-height;
+}
diff --git a/app/assets/stylesheets/framework/images.scss b/app/assets/stylesheets/framework/images.scss
index 59bfc5a8d77..6819fd88b7f 100644
--- a/app/assets/stylesheets/framework/images.scss
+++ b/app/assets/stylesheets/framework/images.scss
@@ -28,6 +28,7 @@
 
 svg {
   &.s8 { @include svg-size(8px); }
+  &.s12 { @include svg-size(12px); }
   &.s16 { @include svg-size(16px); }
   &.s18 { @include svg-size(18px); }
   &.s24 { @include svg-size(24px); }
diff --git a/app/assets/stylesheets/framework/nav.scss b/app/assets/stylesheets/framework/nav.scss
deleted file mode 100644
index 8b137891791..00000000000
--- a/app/assets/stylesheets/framework/nav.scss
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/app/assets/stylesheets/framework/new-nav.scss b/app/assets/stylesheets/framework/new-nav.scss
index a8fe8b31a6b..e69de29bb2d 100644
--- a/app/assets/stylesheets/framework/new-nav.scss
+++ b/app/assets/stylesheets/framework/new-nav.scss
@@ -1,415 +0,0 @@
-.content-wrapper.page-with-new-nav {
-  margin-top: $header-height;
-}
-
-header {
-  .header-content {
-    .dropdown.open {
-      > a {
-        border-bottom-color: $white-light;
-      }
-    }
-
-    .dropdown-menu {
-      margin-top: 4px;
-      min-width: 130px;
-
-      @media (max-width: $screen-xs-max) {
-        left: auto;
-        right: 0;
-      }
-    }
-
-    &.menu-expanded {
-      @media (max-width: $screen-xs-max) {
-        .title-container,
-        .header-logo, {
-          display: none;
-        }
-      }
-    }
-  }
-
-  .dropdown-bold-header {
-    color: $gl-text-color-secondary;
-    font-size: 12px;
-  }
-
-  .navbar-collapse {
-    padding-left: 0;
-    box-shadow: 0;
-
-    @media (max-width: $screen-xs-max) {
-      margin-left: -8px;
-      margin-right: -10px;
-    }
-
-    .nav {
-      > li:not(.hidden-xs) a {
-        @media (max-width: $screen-xs-max) {
-          margin-left: 0;
-          min-width: 100%;
-        }
-      }
-    }
-  }
-
-  .container-fluid {
-
-    .navbar-nav {
-      @media (max-width: $screen-xs-max) {
-        display: -webkit-flex;
-        display: flex;
-        padding-right: 10px;
-      }
-
-      li {
-        .badge {
-          box-shadow: none;
-          font-weight: $gl-font-weight-bold;
-        }
-      }
-    }
-
-    .nav > li {
-      &.header-user {
-        @media (max-width: $screen-xs-max) {
-          padding-left: 10px;
-        }
-      }
-
-      > a {
-        will-change: color;
-        margin: 4px 2px;
-        padding: 6px 8px;
-        height: 32px;
-
-        @media (max-width: $screen-xs-max) {
-          padding: 0;
-        }
-
-        &.header-user-dropdown-toggle {
-          margin-left: 2px;
-
-          .header-user-avatar {
-            margin-right: 0;
-          }
-        }
-
-        &:hover,
-        &:focus {
-          text-decoration: none;
-          outline: 0;
-          opacity: 1;
-          color: $white-light;
-
-          svg {
-            fill: currentColor;
-          }
-
-          &.header-user-dropdown-toggle {
-            .header-user-avatar {
-              border-color: $white-light;
-            }
-          }
-        }
-      }
-
-      .header-new-dropdown-toggle {
-        margin-right: 0;
-      }
-
-      .impersonated-user,
-      .impersonated-user:hover {
-        margin-right: 1px;
-        background-color: $white-light;
-        border-top-right-radius: 0;
-        border-bottom-right-radius: 0;
-      }
-
-      .impersonation-btn,
-      .impersonation-btn:hover {
-        background-color: $white-light;
-        margin-left: 0;
-        border-top-left-radius: 0;
-        border-bottom-left-radius: 0;
-
-        i {
-          color: $orange-500;
-          font-size: 20px;
-        }
-      }
-
-      &.active > a,
-      &.dropdown.open > a {
-
-        svg {
-          fill: currentColor;
-        }
-      }
-    }
-  }
-}
-
-.navbar-sub-nav {
-  display: -webkit-flex;
-  display: flex;
-  margin: 0 0 0 6px;
-
-  .dropdown-chevron {
-    position: relative;
-    top: -1px;
-    font-size: 10px;
-  }
-}
-
-header {
-  .navbar-sub-nav,
-  .navbar-nav {
-    > li {
-      > a:hover,
-      > a:focus {
-        text-decoration: none;
-        outline: 0;
-        color: $white-light;
-
-        svg {
-          fill: currentColor;
-        }
-      }
-
-      > a {
-        display: -webkit-flex;
-        display: flex;
-        align-items: center;
-        justify-content: center;
-        padding: 6px 8px;
-        margin: 4px 2px;
-        font-size: 12px;
-        color: currentColor;
-        border-radius: $border-radius-default;
-        height: 32px;
-        font-weight: $gl-font-weight-bold;
-
-        svg {
-          fill: currentColor;
-        }
-      }
-
-      &.line-separator {
-        margin: 8px;
-      }
-    }
-  }
-}
-
-.caret-down {
-  height: 11px;
-  width: 11px;
-  margin-left: 4px;
-  fill: currentColor;
-}
-
-.header-user .dropdown-menu-nav,
-.header-new .dropdown-menu-nav {
-  margin-top: $dropdown-vertical-offset;
-}
-
-.breadcrumbs {
-  display: -webkit-flex;
-  display: flex;
-  min-height: 48px;
-  color: $gl-text-color;
-}
-
-.breadcrumbs-container {
-  display: -webkit-flex;
-  display: flex;
-  width: 100%;
-  position: relative;
-  padding-top: $gl-padding / 2;
-  padding-bottom: $gl-padding / 2;
-  align-items: center;
-  border-bottom: 1px solid $border-color;
-}
-
-.breadcrumbs-links {
-  -webkit-flex: 1;
-  flex: 1;
-  min-width: 0;
-  align-self: center;
-  color: $gl-text-color-secondary;
-
-  .avatar-tile {
-    margin-right: 4px;
-    border: 1px solid $border-color;
-    border-radius: 50%;
-    vertical-align: sub;
-  }
-
-  .text-expander {
-    margin-left: 0;
-    margin-right: 2px;
-
-    > i {
-      position: relative;
-      top: 1px;
-    }
-  }
-}
-
-.breadcrumbs-list {
-  display: -webkit-flex;
-  display: flex;
-  flex-wrap: wrap;
-  margin-bottom: 0;
-  line-height: 16px;
-
-  > li {
-    display: flex;
-    align-items: center;
-    position: relative;
-    padding: 2px 0;
-
-    &:not(:last-child) {
-      margin-right: 20px;
-    }
-
-    > a {
-      font-size: 12px;
-      color: currentColor;
-    }
-  }
-}
-
-.breadcrumb-item-text {
-  @include str-truncated(128px);
-  text-decoration: inherit;
-}
-
-.breadcrumbs-list-angle {
-  position: absolute;
-  right: -12px;
-  top: 50%;
-  color: $gl-text-color-tertiary;
-  transform: translateY(-50%);
-}
-
-.breadcrumbs-extra {
-  display: -webkit-flex;
-  display: flex;
-  flex: 0 0 auto;
-  margin-left: auto;
-}
-
-.breadcrumbs-sub-title {
-  margin: 0;
-  font-size: 12px;
-  font-weight: 600;
-  line-height: 16px;
-
-  a {
-    color: $gl-text-color;
-  }
-}
-
-.btn-sign-in {
-  margin-top: 3px;
-  font-weight: $gl-font-weight-bold;
-
-  &:hover {
-    background-color: $white-light;
-  }
-}
-
-.navbar-nav {
-  li {
-    .badge {
-      position: inherit;
-      font-weight: $gl-font-weight-normal;
-      margin-left: -6px;
-      font-size: 11px;
-      color: $white-light;
-      padding: 0 5px;
-      line-height: 12px;
-      border-radius: 7px;
-      box-shadow: 0 1px 0 rgba($gl-header-color, .2);
-
-      &.issues-count {
-        background-color: $green-500;
-      }
-
-      &.merge-requests-count {
-        background-color: $orange-600;
-      }
-
-      &.todos-count {
-        background-color: $blue-500;
-      }
-    }
-  }
-}
-
-@media (max-width: $screen-xs-max) {
-  header .container-fluid {
-    font-size: 18px;
-
-    .navbar-nav {
-      display: table;
-      table-layout: fixed;
-      width: 100%;
-      margin: 0;
-      text-align: right;
-    }
-
-    .navbar-collapse {
-      padding-left: 5px;
-
-      .nav > li:not(.hidden-xs) {
-        display: table-cell !important;
-        width: 25%;
-
-        a {
-          margin-right: 8px;
-        }
-      }
-    }
-  }
-
-  .header-user-dropdown-toggle {
-    text-align: center;
-  }
-
-  .header-user-avatar {
-    float: none;
-  }
-}
-
-.header-user {
-  .dropdown-menu-nav {
-    width: auto;
-    min-width: 140px;
-    margin-top: -5px;
-    color: $gl-text-color;
-    left: auto;
-
-    .current-user {
-      padding: 5px 18px;
-
-      .user-name {
-        display: block;
-      }
-    }
-  }
-}
-
-.header-user-avatar {
-  float: left;
-  margin-right: 5px;
-  border-radius: 50%;
-  border: 1px solid $avatar-border;
-}
-
-.with-performance-bar header.navbar-gitlab {
-  top: $performance-bar-height;
-}
diff --git a/app/views/layouts/header/_default.html.haml b/app/views/layouts/header/_default.html.haml
index 3fbe318568e..5ff6ac5fc00 100644
--- a/app/views/layouts/header/_default.html.haml
+++ b/app/views/layouts/header/_default.html.haml
@@ -73,7 +73,7 @@
 
       %button.navbar-toggle.hidden-sm.hidden-md.hidden-lg{ type: 'button' }
         %span.sr-only Toggle navigation
-        = sprite_icon('more', size: 16, css_class: 'more-icon js-navbar-toggle-right')
-        = sprite_icon('close', size: 16, css_class: 'close-icon js-navbar-toggle-left')
+        = sprite_icon('more', size: 12, css_class: 'more-icon js-navbar-toggle-right')
+        = sprite_icon('close', size: 12, css_class: 'close-icon js-navbar-toggle-left')
 
 = render 'shared/outdated_browser'
-- 
cgit v1.2.1


From 9b27f62d86ff8d71710a7e6945414fe115494203 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Fri, 6 Oct 2017 16:44:54 -0700
Subject: Specify gitlab nav

---
 app/assets/stylesheets/framework/gitlab-theme.scss | 6 +++---
 app/assets/stylesheets/framework/header.scss       | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/assets/stylesheets/framework/gitlab-theme.scss b/app/assets/stylesheets/framework/gitlab-theme.scss
index 45cf9b252a3..52b87de7a3d 100644
--- a/app/assets/stylesheets/framework/gitlab-theme.scss
+++ b/app/assets/stylesheets/framework/gitlab-theme.scss
@@ -5,7 +5,7 @@
 @mixin gitlab-theme($color-100, $color-200, $color-500, $color-700, $color-800, $color-900, $color-alternate) {
   // Header
 
-  header {
+  .navbar-gitlab {
     background-color: $color-900;
 
     .navbar-collapse {
@@ -200,9 +200,9 @@ body {
   &.ui_light {
     @include gitlab-theme($theme-gray-900, $theme-gray-700, $theme-gray-800, $theme-gray-700, $theme-gray-700, $theme-gray-100, $theme-gray-700);
 
-    header {
+    .navbar-gitlab {
       background-color: $theme-gray-100;
-      box-shadow: 0 2px 0 0 $border-color;
+      box-shadow: 0 1px 0 0 $border-color;
 
       .logo-text svg {
         fill: $theme-gray-900;
diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index 4693b4a18d7..9b4bfae1144 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -2,7 +2,7 @@
   margin-top: $header-height;
 }
 
-header {
+.navbar-gitlab {
   @include new-style-dropdown;
 
   &.navbar-empty {
@@ -508,7 +508,7 @@ header {
 }
 
 @media (max-width: $screen-xs-max) {
-  header .container-fluid {
+  .navbar-gitlab .container-fluid {
     font-size: 18px;
 
     .navbar-nav {
@@ -567,6 +567,6 @@ header {
   border: 1px solid $avatar-border;
 }
 
-.with-performance-bar header.navbar-gitlab {
+.with-performance-bar .navbar-gitlab {
   top: $performance-bar-height;
 }
-- 
cgit v1.2.1


From b54203f0ada8f7ad6d24437b6f5f46ebf43f8695 Mon Sep 17 00:00:00 2001
From: Felipe Artur <fcardozo@gitlab.com>
Date: Sat, 7 Oct 2017 04:25:17 +0000
Subject: Commenting on image diffs

---
 app/assets/images/icon_image_comment.svg           |   1 +
 app/assets/images/icon_image_comment@2x.svg        |   1 +
 app/assets/javascripts/commit.js                   |  12 -
 app/assets/javascripts/commit/file.js              |  14 -
 app/assets/javascripts/commit/image_file.js        |  13 +-
 app/assets/javascripts/diff.js                     |   5 +-
 .../diff_notes/components/jump_to_discussion.js    |   9 +-
 app/assets/javascripts/dispatcher.js               |   2 -
 .../javascripts/image_diff/helpers/badge_helper.js |  38 +++
 .../image_diff/helpers/comment_indicator_helper.js |  58 ++++
 .../javascripts/image_diff/helpers/dom_helper.js   |  44 +++
 app/assets/javascripts/image_diff/helpers/index.js |  25 ++
 .../javascripts/image_diff/helpers/utils_helper.js |  95 ++++++
 app/assets/javascripts/image_diff/image_badge.js   |  23 ++
 app/assets/javascripts/image_diff/image_diff.js    | 143 ++++++++
 .../javascripts/image_diff/init_discussion_tab.js  |  12 +
 .../javascripts/image_diff/replaced_image_diff.js  |  92 ++++++
 app/assets/javascripts/image_diff/view_types.js    |   9 +
 app/assets/javascripts/lib/utils/image_utility.js  |   5 +
 app/assets/javascripts/main.js                     |   3 -
 app/assets/javascripts/merge_request_tabs.js       |   4 +
 app/assets/javascripts/notes.js                    | 128 +++++++-
 app/assets/javascripts/single_file_diff.js         |   7 +-
 app/assets/stylesheets/framework/buttons.scss      |  22 ++
 app/assets/stylesheets/framework/timeline.scss     |   6 +-
 app/assets/stylesheets/framework/variables.scss    |   7 +
 app/assets/stylesheets/pages/diff.scss             | 168 +++++++++-
 app/assets/stylesheets/pages/note_form.scss        |   5 +-
 app/assets/stylesheets/pages/notes.scss            |  19 +-
 app/controllers/concerns/notes_actions.rb          |  11 +-
 app/models/concerns/discussion_on_diff.rb          |   4 +
 app/models/diff_discussion.rb                      |   2 +
 app/models/diff_note.rb                            |  14 +-
 app/models/discussion.rb                           |   4 +
 app/models/legacy_diff_discussion.rb               |   8 +
 app/models/note.rb                                 |  16 +-
 app/views/discussions/_diff_discussion.html.haml   |  16 +-
 app/views/discussions/_diff_with_notes.html.haml   |  31 +-
 app/views/discussions/_notes.html.haml             |  19 +-
 .../projects/diffs/_image_diff_frame.html.haml     |   5 +
 .../projects/diffs/_replaced_image_diff.html.haml  |  61 ++++
 .../projects/diffs/_single_image_diff.html.haml    |  16 +
 app/views/projects/diffs/viewers/_image.html.haml  |  70 +---
 app/views/shared/notes/_form.html.haml             |  35 +-
 app/views/shared/notes/_note.html.haml             |  15 +-
 changelogs/unreleased/issue_35873.yml              |   5 +
 lib/gitlab/diff/file.rb                            |  29 +-
 lib/gitlab/diff/formatters/base_formatter.rb       |  61 ++++
 lib/gitlab/diff/formatters/image_formatter.rb      |  43 +++
 lib/gitlab/diff/formatters/text_formatter.rb       |  49 +++
 lib/gitlab/diff/image_point.rb                     |  23 ++
 lib/gitlab/diff/position.rb                        |  90 +++--
 spec/factories/merge_requests.rb                   |   5 +
 spec/features/merge_requests/diffs_spec.rb         |   8 +-
 spec/features/merge_requests/image_diff_notes.rb   | 196 +++++++++++
 .../merge_requests/user_posts_diff_notes_spec.rb   |   1 +
 .../image_diff/helpers/badge_helper_spec.js        | 132 ++++++++
 .../helpers/comment_indicator_helper_spec.js       | 139 ++++++++
 .../image_diff/helpers/dom_helper_spec.js          | 118 +++++++
 .../image_diff/helpers/utils_helper_spec.js        | 207 ++++++++++++
 spec/javascripts/image_diff/image_badge_spec.js    |  84 +++++
 spec/javascripts/image_diff/image_diff_spec.js     | 361 +++++++++++++++++++++
 .../image_diff/init_discussion_tab_spec.js         |  37 +++
 spec/javascripts/image_diff/mock_data.js           |  28 ++
 .../image_diff/replaced_image_diff_spec.js         | 312 ++++++++++++++++++
 spec/javascripts/image_diff/view_types_spec.js     |  24 ++
 spec/javascripts/lib/utils/image_utility_spec.js   |  32 ++
 .../gitlab/diff/formatters/image_formatter_spec.rb |  20 ++
 .../gitlab/diff/formatters/text_formatter_spec.rb  |  42 +++
 spec/lib/gitlab/diff/position_spec.rb              |  85 ++++-
 spec/lib/gitlab/diff/position_tracer_spec.rb       |  16 +-
 spec/models/diff_note_spec.rb                      |  40 ++-
 spec/models/note_spec.rb                           |  50 +++
 .../update_diff_position_service_spec.rb           |   6 +-
 .../features/discussion_comments_shared_example.rb |   2 +-
 .../support/shared_examples/position_formatters.rb |  43 +++
 spec/support/test_env.rb                           |   3 +-
 77 files changed, 3318 insertions(+), 270 deletions(-)
 create mode 100644 app/assets/images/icon_image_comment.svg
 create mode 100644 app/assets/images/icon_image_comment@2x.svg
 delete mode 100644 app/assets/javascripts/commit.js
 delete mode 100644 app/assets/javascripts/commit/file.js
 create mode 100644 app/assets/javascripts/image_diff/helpers/badge_helper.js
 create mode 100644 app/assets/javascripts/image_diff/helpers/comment_indicator_helper.js
 create mode 100644 app/assets/javascripts/image_diff/helpers/dom_helper.js
 create mode 100644 app/assets/javascripts/image_diff/helpers/index.js
 create mode 100644 app/assets/javascripts/image_diff/helpers/utils_helper.js
 create mode 100644 app/assets/javascripts/image_diff/image_badge.js
 create mode 100644 app/assets/javascripts/image_diff/image_diff.js
 create mode 100644 app/assets/javascripts/image_diff/init_discussion_tab.js
 create mode 100644 app/assets/javascripts/image_diff/replaced_image_diff.js
 create mode 100644 app/assets/javascripts/image_diff/view_types.js
 create mode 100644 app/assets/javascripts/lib/utils/image_utility.js
 create mode 100644 app/views/projects/diffs/_image_diff_frame.html.haml
 create mode 100644 app/views/projects/diffs/_replaced_image_diff.html.haml
 create mode 100644 app/views/projects/diffs/_single_image_diff.html.haml
 create mode 100644 changelogs/unreleased/issue_35873.yml
 create mode 100644 lib/gitlab/diff/formatters/base_formatter.rb
 create mode 100644 lib/gitlab/diff/formatters/image_formatter.rb
 create mode 100644 lib/gitlab/diff/formatters/text_formatter.rb
 create mode 100644 lib/gitlab/diff/image_point.rb
 create mode 100644 spec/features/merge_requests/image_diff_notes.rb
 create mode 100644 spec/javascripts/image_diff/helpers/badge_helper_spec.js
 create mode 100644 spec/javascripts/image_diff/helpers/comment_indicator_helper_spec.js
 create mode 100644 spec/javascripts/image_diff/helpers/dom_helper_spec.js
 create mode 100644 spec/javascripts/image_diff/helpers/utils_helper_spec.js
 create mode 100644 spec/javascripts/image_diff/image_badge_spec.js
 create mode 100644 spec/javascripts/image_diff/image_diff_spec.js
 create mode 100644 spec/javascripts/image_diff/init_discussion_tab_spec.js
 create mode 100644 spec/javascripts/image_diff/mock_data.js
 create mode 100644 spec/javascripts/image_diff/replaced_image_diff_spec.js
 create mode 100644 spec/javascripts/image_diff/view_types_spec.js
 create mode 100644 spec/javascripts/lib/utils/image_utility_spec.js
 create mode 100644 spec/lib/gitlab/diff/formatters/image_formatter_spec.rb
 create mode 100644 spec/lib/gitlab/diff/formatters/text_formatter_spec.rb
 create mode 100644 spec/support/shared_examples/position_formatters.rb

diff --git a/app/assets/images/icon_image_comment.svg b/app/assets/images/icon_image_comment.svg
new file mode 100644
index 00000000000..cf6cb972940
--- /dev/null
+++ b/app/assets/images/icon_image_comment.svg
@@ -0,0 +1 @@
+<svg width="24" height="30" viewBox="0 0 24 30" xmlns="http://www.w3.org/2000/svg"><title>cursor</title><g fill="none" fill-rule="evenodd"><path d="M24 12.105c0 6.686-5.74 11.58-12 17.895C5.74 23.684 0 18.79 0 12.105 0 5.42 5.373 0 12 0s12 5.42 12 12.105z" fill="#1F78D1" fill-rule="nonzero"/><path d="M15.28 25.249c1.458-1.475 2.539-2.635 3.474-3.747 2.851-3.394 4.203-6.265 4.203-9.397 0-6.111-4.908-11.062-10.957-11.062-6.05 0-10.957 4.951-10.957 11.062 0 3.132 1.352 6.003 4.203 9.397.935 1.112 2.016 2.272 3.474 3.747.511.517 2.216 2.213 3.28 3.275 1.064-1.062 2.769-2.758 3.28-3.275z" fill="#FFF"/><path d="M14.551 8.256A6.874 6.874 0 0 0 12 7.787c-.91 0-1.763.156-2.558.469-.79.308-1.42.725-1.888 1.252-.465.527-.697 1.096-.697 1.708 0 .5.159.977.476 1.433.321.45.772.841 1.352 1.172l.583.334-.181.643c-.107.407-.263.79-.469 1.152a6.604 6.604 0 0 0 1.842-1.145l.288-.254.381.04c.309.035.599.053.871.053.91 0 1.761-.154 2.551-.462.795-.312 1.424-.732 1.889-1.259.468-.526.703-1.096.703-1.707 0-.612-.235-1.181-.703-1.708-.465-.527-1.094-.944-1.889-1.252zm2.645.81c.536.656.804 1.373.804 2.15 0 .776-.268 1.495-.804 2.156-.535.656-1.263 1.176-2.183 1.56-.92.38-1.924.57-3.013.57a9.16 9.16 0 0 1-.971-.054 7.32 7.32 0 0 1-3.08 1.62 5.044 5.044 0 0 1-.764.148h-.033a.26.26 0 0 1-.181-.074.324.324 0 0 1-.107-.18v-.007c-.014-.018-.016-.045-.007-.08.014-.037.018-.059.014-.068 0-.009.01-.031.033-.067a.645.645 0 0 0 .04-.06 1.73 1.73 0 0 0 .047-.054l.054-.06a53.034 53.034 0 0 1 .435-.489c.049-.049.118-.136.207-.26.094-.126.168-.24.221-.342.054-.103.114-.235.181-.395.067-.161.125-.33.174-.51-.7-.397-1.254-.888-1.66-1.473A3.261 3.261 0 0 1 6 11.216c0-.777.268-1.494.804-2.15.535-.66 1.263-1.18 2.183-1.56.92-.384 1.924-.576 3.013-.576 1.09 0 2.094.192 3.013.576.92.38 1.648.9 2.183 1.56z" fill="#1F78D1" fill-rule="nonzero"/></g></svg>
diff --git a/app/assets/images/icon_image_comment@2x.svg b/app/assets/images/icon_image_comment@2x.svg
new file mode 100644
index 00000000000..83be91d3705
--- /dev/null
+++ b/app/assets/images/icon_image_comment@2x.svg
@@ -0,0 +1 @@
+<svg width="48" height="60" viewBox="0 0 48 60" xmlns="http://www.w3.org/2000/svg"><title>cursor_2x</title><g fill="none" fill-rule="evenodd"><path d="M48 24.21C48 37.583 36.522 47.369 24 60 11.478 47.368 0 37.582 0 24.21 0 10.84 10.745 0 24 0s24 10.84 24 24.21z" fill="#1F78D1" fill-rule="nonzero"/><path d="M30.56 50.497c2.915-2.95 5.078-5.268 6.947-7.493 5.703-6.788 8.406-12.53 8.406-18.793 0-12.223-9.815-22.124-21.913-22.124S2.087 11.988 2.087 24.211c0 6.263 2.703 12.005 8.406 18.793 1.87 2.225 4.032 4.544 6.947 7.493 1.022 1.035 4.432 4.426 6.56 6.55 2.128-2.124 5.538-5.515 6.56-6.55z" fill="#FFF"/><path d="M29.103 16.512c-1.58-.625-3.282-.938-5.103-.938-1.821 0-3.527.313-5.116.938-1.58.616-2.84 1.45-3.777 2.504-.928 1.054-1.393 2.192-1.393 3.415 0 1 .317 1.956.951 2.866.643.902 1.545 1.684 2.706 2.344l1.165.67-.362 1.286a9.603 9.603 0 0 1-.937 2.303 13.208 13.208 0 0 0 3.683-2.29l.576-.509.763.08c.616.072 1.196.108 1.741.108 1.821 0 3.522-.308 5.103-.925 1.589-.625 2.848-1.464 3.776-2.517.938-1.054 1.407-2.192 1.407-3.416 0-1.223-.469-2.361-1.407-3.415-.928-1.053-2.187-1.888-3.776-2.504zm5.29 1.62c1.071 1.313 1.607 2.746 1.607 4.3 0 1.553-.536 2.99-1.607 4.312-1.072 1.312-2.527 2.353-4.366 3.12-1.84.76-3.848 1.139-6.027 1.139a18.32 18.32 0 0 1-1.942-.107c-1.768 1.562-3.821 2.643-6.16 3.24-.438.126-.947.224-1.527.295h-.067a.521.521 0 0 1-.362-.147.649.649 0 0 1-.214-.362v-.013c-.027-.036-.032-.09-.014-.16.027-.072.036-.117.027-.135 0-.017.022-.062.067-.133a1.29 1.29 0 0 0 .08-.121c.01-.009.04-.045.094-.107a106.068 106.068 0 0 1 .522-.59c.215-.232.367-.401.456-.508.098-.099.236-.273.415-.523.188-.25.335-.477.442-.683.107-.205.228-.468.362-.79.134-.321.25-.66.348-1.018-1.402-.794-2.51-1.777-3.322-2.946C12.402 25.025 12 23.77 12 22.43c0-1.553.536-2.986 1.607-4.299 1.072-1.321 2.527-2.361 4.366-3.12 1.84-.768 3.848-1.152 6.027-1.152 2.179 0 4.188.384 6.027 1.152 1.84.759 3.294 1.799 4.366 3.12z" fill="#1F78D1" fill-rule="nonzero"/></g></svg>
diff --git a/app/assets/javascripts/commit.js b/app/assets/javascripts/commit.js
deleted file mode 100644
index 5f637524e30..00000000000
--- a/app/assets/javascripts/commit.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/* eslint-disable func-names, space-before-function-paren, wrap-iife */
-/* global CommitFile */
-
-window.Commit = (function() {
-  function Commit() {
-    $('.files .diff-file').each(function() {
-      return new CommitFile(this);
-    });
-  }
-
-  return Commit;
-})();
diff --git a/app/assets/javascripts/commit/file.js b/app/assets/javascripts/commit/file.js
deleted file mode 100644
index ee087c978dd..00000000000
--- a/app/assets/javascripts/commit/file.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/* eslint-disable func-names, space-before-function-paren, wrap-iife, no-new */
-/* global ImageFile */
-
-(function() {
-  this.CommitFile = (function() {
-    function CommitFile(file) {
-      if ($('.image', file).length) {
-        new gl.ImageFile(file);
-      }
-    }
-
-    return CommitFile;
-  })();
-}).call(window);
diff --git a/app/assets/javascripts/commit/image_file.js b/app/assets/javascripts/commit/image_file.js
index 4763985c802..e7adf8814b8 100644
--- a/app/assets/javascripts/commit/image_file.js
+++ b/app/assets/javascripts/commit/image_file.js
@@ -1,4 +1,6 @@
 /* eslint-disable func-names, space-before-function-paren, wrap-iife, no-var, no-use-before-define, prefer-arrow-callback, no-else-return, consistent-return, prefer-template, quotes, one-var, one-var-declaration-per-line, no-unused-vars, no-return-assign, comma-dangle, quote-props, no-unused-expressions, no-sequences, object-shorthand, max-len */
+import 'vendor/jquery.waitforimages';
+
 (function() {
   gl.ImageFile = (function() {
     var prepareFrames;
@@ -17,15 +19,10 @@
 
             // Load two-up view after images are loaded
             // so that we can display the correct width and height information
-            const images = $('.two-up.view img', _this.file);
-            let loadedCount = 0;
-
-            images.on('load', () => {
-              loadedCount += 1;
+            const $images = $('.two-up.view img', _this.file);
 
-              if (loadedCount === images.length) {
-                _this.initView('two-up');
-              }
+            $images.waitForImages(function() {
+              _this.initView('two-up');
             });
           });
         };
diff --git a/app/assets/javascripts/diff.js b/app/assets/javascripts/diff.js
index 9ddfdb6ae21..6c78662baa7 100644
--- a/app/assets/javascripts/diff.js
+++ b/app/assets/javascripts/diff.js
@@ -3,6 +3,7 @@
 import './lib/utils/url_utility';
 import FilesCommentButton from './files_comment_button';
 import SingleFileDiff from './single_file_diff';
+import imageDiffHelper from './image_diff/helpers/index';
 
 const UNFOLD_COUNT = 20;
 let isBound = false;
@@ -20,7 +21,9 @@ class Diff {
     const tab = document.getElementById('diffs');
     if (!tab || (tab && tab.dataset && tab.dataset.isLocked !== '')) FilesCommentButton.init($diffFile);
 
-    $diffFile.each((index, file) => new gl.ImageFile(file));
+    const firstFile = $('.files').first().get(0);
+    const canCreateNote = firstFile && firstFile.hasAttribute('data-can-create-note');
+    $diffFile.each((index, file) => imageDiffHelper.initImageDiff(file, canCreateNote));
 
     if (!isBound) {
       $(document)
diff --git a/app/assets/javascripts/diff_notes/components/jump_to_discussion.js b/app/assets/javascripts/diff_notes/components/jump_to_discussion.js
index 497c23f014f..e77910a83d4 100644
--- a/app/assets/javascripts/diff_notes/components/jump_to_discussion.js
+++ b/app/assets/javascripts/diff_notes/components/jump_to_discussion.js
@@ -171,7 +171,14 @@ const JumpToDiscussion = Vue.extend({
         // When jumping between unresolved discussions on the diffs tab, we show them.
         $target.closest(".content").show();
 
-        $target = $target.closest("tr.notes_holder");
+        const $notesHolder = $target.closest("tr.notes_holder");
+
+        // Image diff discussions does not use notes_holder
+        // so we should keep original $target value in those cases
+        if ($notesHolder.length > 0) {
+          $target = $notesHolder;
+        }
+
         $target.show();
 
         // If we are on the diffs tab, we don't scroll to the discussion itself, but to
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index e4e7cae540e..33271c25146 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -7,7 +7,6 @@
 /* global IssuableForm */
 /* global LabelsSelect */
 /* global MilestoneSelect */
-/* global Commit */
 /* global CommitsList */
 /* global NewBranchForm */
 /* global NotificationsForm */
@@ -316,7 +315,6 @@ import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
           new gl.Activities();
           break;
         case 'projects:commit:show':
-          new Commit();
           new gl.Diff();
           new ZenMode();
           shortcut_handler = new ShortcutsNavigation();
diff --git a/app/assets/javascripts/image_diff/helpers/badge_helper.js b/app/assets/javascripts/image_diff/helpers/badge_helper.js
new file mode 100644
index 00000000000..6a6a668308d
--- /dev/null
+++ b/app/assets/javascripts/image_diff/helpers/badge_helper.js
@@ -0,0 +1,38 @@
+export function createImageBadge(noteId, { x, y }, classNames = []) {
+  const buttonEl = document.createElement('button');
+  const classList = classNames.concat(['js-image-badge']);
+  classList.forEach(className => buttonEl.classList.add(className));
+  buttonEl.setAttribute('type', 'button');
+  buttonEl.setAttribute('disabled', true);
+  buttonEl.dataset.noteId = noteId;
+  buttonEl.style.left = `${x}px`;
+  buttonEl.style.top = `${y}px`;
+
+  return buttonEl;
+}
+
+export function addImageBadge(containerEl, { coordinate, badgeText, noteId }) {
+  const buttonEl = createImageBadge(noteId, coordinate, ['badge']);
+  buttonEl.innerText = badgeText;
+
+  containerEl.appendChild(buttonEl);
+}
+
+export function addImageCommentBadge(containerEl, { coordinate, noteId }) {
+  const buttonEl = createImageBadge(noteId, coordinate, ['image-comment-badge', 'inverted']);
+  const iconEl = document.createElement('i');
+  iconEl.className = 'fa fa-comment-o';
+  iconEl.setAttribute('aria-label', 'comment');
+
+  buttonEl.appendChild(iconEl);
+  containerEl.appendChild(buttonEl);
+}
+
+export function addAvatarBadge(el, event) {
+  const { noteId, badgeNumber } = event.detail;
+
+  // Add badge to new comment
+  const avatarBadgeEl = el.querySelector(`#${noteId} .badge`);
+  avatarBadgeEl.innerText = badgeNumber;
+  avatarBadgeEl.classList.remove('hidden');
+}
diff --git a/app/assets/javascripts/image_diff/helpers/comment_indicator_helper.js b/app/assets/javascripts/image_diff/helpers/comment_indicator_helper.js
new file mode 100644
index 00000000000..05000c73052
--- /dev/null
+++ b/app/assets/javascripts/image_diff/helpers/comment_indicator_helper.js
@@ -0,0 +1,58 @@
+export function addCommentIndicator(containerEl, { x, y }) {
+  const buttonEl = document.createElement('button');
+  buttonEl.classList.add('btn-transparent');
+  buttonEl.classList.add('comment-indicator');
+  buttonEl.setAttribute('type', 'button');
+  buttonEl.style.left = `${x}px`;
+  buttonEl.style.top = `${y}px`;
+
+  buttonEl.innerHTML = gl.utils.spriteIcon('image-comment-dark');
+
+  containerEl.appendChild(buttonEl);
+}
+
+export function removeCommentIndicator(imageFrameEl) {
+  const commentIndicatorEl = imageFrameEl.querySelector('.comment-indicator');
+  const imageEl = imageFrameEl.querySelector('img');
+  const willRemove = !!commentIndicatorEl;
+  let meta = {};
+
+  if (willRemove) {
+    meta = {
+      x: parseInt(commentIndicatorEl.style.left, 10),
+      y: parseInt(commentIndicatorEl.style.top, 10),
+      image: {
+        width: imageEl.width,
+        height: imageEl.height,
+      },
+    };
+
+    commentIndicatorEl.remove();
+  }
+
+  return Object.assign({}, meta, {
+    removed: willRemove,
+  });
+}
+
+export function showCommentIndicator(imageFrameEl, coordinate) {
+  const { x, y } = coordinate;
+  const commentIndicatorEl = imageFrameEl.querySelector('.comment-indicator');
+
+  if (commentIndicatorEl) {
+    commentIndicatorEl.style.left = `${x}px`;
+    commentIndicatorEl.style.top = `${y}px`;
+  } else {
+    addCommentIndicator(imageFrameEl, coordinate);
+  }
+}
+
+export function commentIndicatorOnClick(event) {
+  // Prevent from triggering onAddImageDiffNote in notes.js
+  event.stopPropagation();
+
+  const buttonEl = event.currentTarget;
+  const diffViewerEl = buttonEl.closest('.diff-viewer');
+  const textareaEl = diffViewerEl.querySelector('.note-container .note-textarea');
+  textareaEl.focus();
+}
diff --git a/app/assets/javascripts/image_diff/helpers/dom_helper.js b/app/assets/javascripts/image_diff/helpers/dom_helper.js
new file mode 100644
index 00000000000..12d56714b34
--- /dev/null
+++ b/app/assets/javascripts/image_diff/helpers/dom_helper.js
@@ -0,0 +1,44 @@
+export function setPositionDataAttribute(el, options) {
+  // Update position data attribute so that the
+  // new comment form can use this data for ajax request
+  const { x, y, width, height } = options;
+  const position = el.dataset.position;
+  const positionObject = Object.assign({}, JSON.parse(position), {
+    x,
+    y,
+    width,
+    height,
+  });
+
+  el.setAttribute('data-position', JSON.stringify(positionObject));
+}
+
+export function updateDiscussionAvatarBadgeNumber(discussionEl, newBadgeNumber) {
+  const avatarBadgeEl = discussionEl.querySelector('.image-diff-avatar-link .badge');
+  avatarBadgeEl.innerText = newBadgeNumber;
+}
+
+export function updateDiscussionBadgeNumber(discussionEl, newBadgeNumber) {
+  const discussionBadgeEl = discussionEl.querySelector('.badge');
+  discussionBadgeEl.innerText = newBadgeNumber;
+}
+
+export function toggleCollapsed(event) {
+  const toggleButtonEl = event.currentTarget;
+  const discussionNotesEl = toggleButtonEl.closest('.discussion-notes');
+  const formEl = discussionNotesEl.querySelector('.discussion-form');
+  const isCollapsed = discussionNotesEl.classList.contains('collapsed');
+
+  if (isCollapsed) {
+    discussionNotesEl.classList.remove('collapsed');
+  } else {
+    discussionNotesEl.classList.add('collapsed');
+  }
+
+  // Override the inline display style set in notes.js
+  if (formEl && !isCollapsed) {
+    formEl.style.display = 'none';
+  } else if (formEl && isCollapsed) {
+    formEl.style.display = 'block';
+  }
+}
diff --git a/app/assets/javascripts/image_diff/helpers/index.js b/app/assets/javascripts/image_diff/helpers/index.js
new file mode 100644
index 00000000000..4a100631003
--- /dev/null
+++ b/app/assets/javascripts/image_diff/helpers/index.js
@@ -0,0 +1,25 @@
+import * as badgeHelper from './badge_helper';
+import * as commentIndicatorHelper from './comment_indicator_helper';
+import * as domHelper from './dom_helper';
+import * as utilsHelper from './utils_helper';
+
+export default {
+  addCommentIndicator: commentIndicatorHelper.addCommentIndicator,
+  removeCommentIndicator: commentIndicatorHelper.removeCommentIndicator,
+  showCommentIndicator: commentIndicatorHelper.showCommentIndicator,
+  commentIndicatorOnClick: commentIndicatorHelper.commentIndicatorOnClick,
+
+  addImageBadge: badgeHelper.addImageBadge,
+  addImageCommentBadge: badgeHelper.addImageCommentBadge,
+  addAvatarBadge: badgeHelper.addAvatarBadge,
+
+  setPositionDataAttribute: domHelper.setPositionDataAttribute,
+  updateDiscussionAvatarBadgeNumber: domHelper.updateDiscussionAvatarBadgeNumber,
+  updateDiscussionBadgeNumber: domHelper.updateDiscussionBadgeNumber,
+  toggleCollapsed: domHelper.toggleCollapsed,
+
+  resizeCoordinatesToImageElement: utilsHelper.resizeCoordinatesToImageElement,
+  generateBadgeFromDiscussionDOM: utilsHelper.generateBadgeFromDiscussionDOM,
+  getTargetSelection: utilsHelper.getTargetSelection,
+  initImageDiff: utilsHelper.initImageDiff,
+};
diff --git a/app/assets/javascripts/image_diff/helpers/utils_helper.js b/app/assets/javascripts/image_diff/helpers/utils_helper.js
new file mode 100644
index 00000000000..96fc735e629
--- /dev/null
+++ b/app/assets/javascripts/image_diff/helpers/utils_helper.js
@@ -0,0 +1,95 @@
+import ImageBadge from '../image_badge';
+import ImageDiff from '../image_diff';
+import ReplacedImageDiff from '../replaced_image_diff';
+import '../../commit/image_file';
+
+export function resizeCoordinatesToImageElement(imageEl, meta) {
+  const { x, y, width, height } = meta;
+
+  const imageWidth = imageEl.width;
+  const imageHeight = imageEl.height;
+
+  const widthRatio = imageWidth / width;
+  const heightRatio = imageHeight / height;
+
+  return {
+    x: Math.round(x * widthRatio),
+    y: Math.round(y * heightRatio),
+    width: imageWidth,
+    height: imageHeight,
+  };
+}
+
+export function generateBadgeFromDiscussionDOM(imageFrameEl, discussionEl) {
+  const position = JSON.parse(discussionEl.dataset.position);
+  const firstNoteEl = discussionEl.querySelector('.note');
+  const badge = new ImageBadge({
+    actual: position,
+    imageEl: imageFrameEl.querySelector('img'),
+    noteId: firstNoteEl.id,
+    discussionId: discussionEl.dataset.discussionId,
+  });
+
+  return badge;
+}
+
+export function getTargetSelection(event) {
+  const containerEl = event.currentTarget;
+  const imageEl = containerEl.querySelector('img');
+
+  const x = event.offsetX;
+  const y = event.offsetY;
+
+  const width = imageEl.width;
+  const height = imageEl.height;
+
+  const actualWidth = imageEl.naturalWidth;
+  const actualHeight = imageEl.naturalHeight;
+
+  const widthRatio = actualWidth / width;
+  const heightRatio = actualHeight / height;
+
+  // Browser will include the frame as a clickable target,
+  // which would result in potential 1px out of bounds value
+  // This bound the coordinates to inside the frame
+  const normalizedX = Math.max(0, x) && Math.min(x, width);
+  const normalizedY = Math.max(0, y) && Math.min(y, height);
+
+  return {
+    browser: {
+      x: normalizedX,
+      y: normalizedY,
+      width,
+      height,
+    },
+    actual: {
+      // Round x, y so that we don't need to deal with decimals
+      x: Math.round(normalizedX * widthRatio),
+      y: Math.round(normalizedY * heightRatio),
+      width: actualWidth,
+      height: actualHeight,
+    },
+  };
+}
+
+export function initImageDiff(fileEl, canCreateNote, renderCommentBadge) {
+  const options = {
+    canCreateNote,
+    renderCommentBadge,
+  };
+  let diff;
+
+  // ImageFile needs to be invoked before initImageDiff so that badges
+  // can mount to the correct location
+  new gl.ImageFile(fileEl); // eslint-disable-line no-new
+
+  if (fileEl.querySelector('.diff-file .js-single-image')) {
+    diff = new ImageDiff(fileEl, options);
+    diff.init();
+  } else if (fileEl.querySelector('.diff-file .js-replaced-image')) {
+    diff = new ReplacedImageDiff(fileEl, options);
+    diff.init();
+  }
+
+  return diff;
+}
diff --git a/app/assets/javascripts/image_diff/image_badge.js b/app/assets/javascripts/image_diff/image_badge.js
new file mode 100644
index 00000000000..51a8cda98d7
--- /dev/null
+++ b/app/assets/javascripts/image_diff/image_badge.js
@@ -0,0 +1,23 @@
+import imageDiffHelper from './helpers/index';
+
+const defaultMeta = {
+  x: 0,
+  y: 0,
+  width: 0,
+  height: 0,
+};
+
+export default class ImageBadge {
+  constructor(options) {
+    const { noteId, discussionId } = options;
+
+    this.actual = options.actual || defaultMeta;
+    this.browser = options.browser || defaultMeta;
+    this.noteId = noteId;
+    this.discussionId = discussionId;
+
+    if (options.imageEl && !options.browser) {
+      this.browser = imageDiffHelper.resizeCoordinatesToImageElement(options.imageEl, this.actual);
+    }
+  }
+}
diff --git a/app/assets/javascripts/image_diff/image_diff.js b/app/assets/javascripts/image_diff/image_diff.js
new file mode 100644
index 00000000000..f3af92cf2b0
--- /dev/null
+++ b/app/assets/javascripts/image_diff/image_diff.js
@@ -0,0 +1,143 @@
+import imageDiffHelper from './helpers/index';
+import ImageBadge from './image_badge';
+import { isImageLoaded } from '../lib/utils/image_utility';
+
+export default class ImageDiff {
+  constructor(el, options) {
+    this.el = el;
+    this.canCreateNote = !!(options && options.canCreateNote);
+    this.renderCommentBadge = !!(options && options.renderCommentBadge);
+    this.$noteContainer = $('.note-container', this.el);
+    this.imageBadges = [];
+  }
+
+  init() {
+    this.imageFrameEl = this.el.querySelector('.diff-file .js-image-frame');
+    this.imageEl = this.imageFrameEl.querySelector('img');
+
+    this.bindEvents();
+  }
+
+  bindEvents() {
+    this.imageClickedWrapper = this.imageClicked.bind(this);
+    this.imageBlurredWrapper = imageDiffHelper.removeCommentIndicator.bind(null, this.imageFrameEl);
+    this.addBadgeWrapper = this.addBadge.bind(this);
+    this.removeBadgeWrapper = this.removeBadge.bind(this);
+    this.renderBadgesWrapper = this.renderBadges.bind(this);
+
+    // Render badges
+    if (isImageLoaded(this.imageEl)) {
+      this.renderBadges();
+    } else {
+      this.imageEl.addEventListener('load', this.renderBadgesWrapper);
+    }
+
+    // jquery makes the event delegation here much simpler
+    this.$noteContainer.on('click', '.js-diff-notes-toggle', imageDiffHelper.toggleCollapsed);
+    $(this.el).on('click', '.comment-indicator', imageDiffHelper.commentIndicatorOnClick);
+
+    if (this.canCreateNote) {
+      this.el.addEventListener('click.imageDiff', this.imageClickedWrapper);
+      this.el.addEventListener('blur.imageDiff', this.imageBlurredWrapper);
+      this.el.addEventListener('addBadge.imageDiff', this.addBadgeWrapper);
+      this.el.addEventListener('removeBadge.imageDiff', this.removeBadgeWrapper);
+    }
+  }
+
+  imageClicked(event) {
+    const customEvent = event.detail;
+    const selection = imageDiffHelper.getTargetSelection(customEvent);
+    const el = customEvent.currentTarget;
+
+    imageDiffHelper.setPositionDataAttribute(el, selection.actual);
+    imageDiffHelper.showCommentIndicator(this.imageFrameEl, selection.browser);
+  }
+
+  renderBadges() {
+    const discussionsEls = this.el.querySelectorAll('.note-container .discussion-notes .notes');
+    [...discussionsEls].forEach(this.renderBadge.bind(this));
+  }
+
+  renderBadge(discussionEl, index) {
+    const imageBadge = imageDiffHelper
+      .generateBadgeFromDiscussionDOM(this.imageFrameEl, discussionEl);
+
+    this.imageBadges.push(imageBadge);
+
+    const options = {
+      coordinate: imageBadge.browser,
+      noteId: imageBadge.noteId,
+    };
+
+    if (this.renderCommentBadge) {
+      imageDiffHelper.addImageCommentBadge(this.imageFrameEl, options);
+    } else {
+      const numberBadgeOptions = Object.assign({}, options, {
+        badgeText: index + 1,
+      });
+
+      imageDiffHelper.addImageBadge(this.imageFrameEl, numberBadgeOptions);
+    }
+  }
+
+  addBadge(event) {
+    const { x, y, width, height, noteId, discussionId } = event.detail;
+    const badgeText = this.imageBadges.length + 1;
+    const imageBadge = new ImageBadge({
+      actual: {
+        x,
+        y,
+        width,
+        height,
+      },
+      imageEl: this.imageFrameEl.querySelector('img'),
+      noteId,
+      discussionId,
+    });
+
+    this.imageBadges.push(imageBadge);
+
+    imageDiffHelper.addImageBadge(this.imageFrameEl, {
+      coordinate: imageBadge.browser,
+      badgeText,
+      noteId,
+    });
+
+    imageDiffHelper.addAvatarBadge(this.el, {
+      detail: {
+        noteId,
+        badgeNumber: badgeText,
+      },
+    });
+
+    const discussionEl = this.el.querySelector(`#discussion_${discussionId}`);
+    imageDiffHelper.updateDiscussionBadgeNumber(discussionEl, badgeText);
+  }
+
+  removeBadge(event) {
+    const { badgeNumber } = event.detail;
+    const indexToRemove = badgeNumber - 1;
+    const imageBadgeEls = this.imageFrameEl.querySelectorAll('.badge');
+
+    if (this.imageBadges.length !== badgeNumber) {
+      // Cascade badges count numbers for (avatar badges + image badges)
+      this.imageBadges.forEach((badge, index) => {
+        if (index > indexToRemove) {
+          const { discussionId } = badge;
+          const updatedBadgeNumber = index;
+          const discussionEl = this.el.querySelector(`#discussion_${discussionId}`);
+
+          imageBadgeEls[index].innerText = updatedBadgeNumber;
+
+          imageDiffHelper.updateDiscussionBadgeNumber(discussionEl, updatedBadgeNumber);
+          imageDiffHelper.updateDiscussionAvatarBadgeNumber(discussionEl, updatedBadgeNumber);
+        }
+      });
+    }
+
+    this.imageBadges.splice(indexToRemove, 1);
+
+    const imageBadgeEl = imageBadgeEls[indexToRemove];
+    imageBadgeEl.remove();
+  }
+}
diff --git a/app/assets/javascripts/image_diff/init_discussion_tab.js b/app/assets/javascripts/image_diff/init_discussion_tab.js
new file mode 100644
index 00000000000..2f16c6ef115
--- /dev/null
+++ b/app/assets/javascripts/image_diff/init_discussion_tab.js
@@ -0,0 +1,12 @@
+import imageDiffHelper from './helpers/index';
+
+export default () => {
+  // Always pass can-create-note as false because a user
+  // cannot place new badge markers on discussion tab
+  const canCreateNote = false;
+  const renderCommentBadge = true;
+
+  const diffFileEls = document.querySelectorAll('.timeline-content .diff-file.js-image-file');
+  [...diffFileEls].forEach(diffFileEl =>
+    imageDiffHelper.initImageDiff(diffFileEl, canCreateNote, renderCommentBadge));
+};
diff --git a/app/assets/javascripts/image_diff/replaced_image_diff.js b/app/assets/javascripts/image_diff/replaced_image_diff.js
new file mode 100644
index 00000000000..4abd13fb472
--- /dev/null
+++ b/app/assets/javascripts/image_diff/replaced_image_diff.js
@@ -0,0 +1,92 @@
+import imageDiffHelper from './helpers/index';
+import { viewTypes, isValidViewType } from './view_types';
+import ImageDiff from './image_diff';
+
+export default class ReplacedImageDiff extends ImageDiff {
+  init(defaultViewType = viewTypes.TWO_UP) {
+    this.imageFrameEls = {
+      [viewTypes.TWO_UP]: this.el.querySelector('.two-up .js-image-frame'),
+      [viewTypes.SWIPE]: this.el.querySelector('.swipe .js-image-frame'),
+      [viewTypes.ONION_SKIN]: this.el.querySelector('.onion-skin .js-image-frame'),
+    };
+
+    const viewModesEl = this.el.querySelector('.view-modes-menu');
+    this.viewModesEls = {
+      [viewTypes.TWO_UP]: viewModesEl.querySelector('.two-up'),
+      [viewTypes.SWIPE]: viewModesEl.querySelector('.swipe'),
+      [viewTypes.ONION_SKIN]: viewModesEl.querySelector('.onion-skin'),
+    };
+
+    this.currentView = defaultViewType;
+    this.generateImageEls();
+    this.bindEvents();
+  }
+
+  generateImageEls() {
+    this.imageEls = {};
+
+    const viewTypeNames = Object.getOwnPropertyNames(viewTypes);
+    viewTypeNames.forEach((viewType) => {
+      this.imageEls[viewType] = this.imageFrameEls[viewType].querySelector('img');
+    });
+  }
+
+  bindEvents() {
+    super.bindEvents();
+
+    this.changeToViewTwoUp = this.changeView.bind(this, viewTypes.TWO_UP);
+    this.changeToViewSwipe = this.changeView.bind(this, viewTypes.SWIPE);
+    this.changeToViewOnionSkin = this.changeView.bind(this, viewTypes.ONION_SKIN);
+
+    this.viewModesEls[viewTypes.TWO_UP].addEventListener('click', this.changeToViewTwoUp);
+    this.viewModesEls[viewTypes.SWIPE].addEventListener('click', this.changeToViewSwipe);
+    this.viewModesEls[viewTypes.ONION_SKIN].addEventListener('click', this.changeToViewOnionSkin);
+  }
+
+  get imageEl() {
+    return this.imageEls[this.currentView];
+  }
+
+  get imageFrameEl() {
+    return this.imageFrameEls[this.currentView];
+  }
+
+  changeView(newView) {
+    if (!isValidViewType(newView)) {
+      return;
+    }
+
+    const indicator = imageDiffHelper.removeCommentIndicator(this.imageFrameEl);
+
+    this.currentView = newView;
+
+    // Clear existing badges on new view
+    const existingBadges = this.imageFrameEl.querySelectorAll('.badge');
+    [...existingBadges].map(badge => badge.remove());
+
+    // Remove existing references to old view image badges
+    this.imageBadges = [];
+
+    // Image_file.js has a fade animation of 200ms for loading the view
+    // Need to wait an additional 250ms for the images to be displayed
+    // on window in order to re-normalize their dimensions
+    setTimeout(this.renderNewView.bind(this, indicator), 250);
+  }
+
+  renderNewView(indicator) {
+    // Generate badge coordinates on new view
+    this.renderBadges();
+
+    // Re-render indicator in new view
+    if (indicator.removed) {
+      const normalizedIndicator = imageDiffHelper
+        .resizeCoordinatesToImageElement(this.imageEl, {
+          x: indicator.x,
+          y: indicator.y,
+          width: indicator.image.width,
+          height: indicator.image.height,
+        });
+      imageDiffHelper.showCommentIndicator(this.imageFrameEl, normalizedIndicator);
+    }
+  }
+}
diff --git a/app/assets/javascripts/image_diff/view_types.js b/app/assets/javascripts/image_diff/view_types.js
new file mode 100644
index 00000000000..ab0a595571f
--- /dev/null
+++ b/app/assets/javascripts/image_diff/view_types.js
@@ -0,0 +1,9 @@
+export const viewTypes = {
+  TWO_UP: 'TWO_UP',
+  SWIPE: 'SWIPE',
+  ONION_SKIN: 'ONION_SKIN',
+};
+
+export function isValidViewType(validate) {
+  return !!Object.getOwnPropertyNames(viewTypes).find(viewType => viewType === validate);
+}
diff --git a/app/assets/javascripts/lib/utils/image_utility.js b/app/assets/javascripts/lib/utils/image_utility.js
new file mode 100644
index 00000000000..2977ec821cb
--- /dev/null
+++ b/app/assets/javascripts/lib/utils/image_utility.js
@@ -0,0 +1,5 @@
+/* eslint-disable import/prefer-default-export */
+
+export function isImageLoaded(element) {
+  return element.complete && element.naturalHeight !== 0;
+}
diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 2c1dcc374ff..5858c2b6fd8 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -35,8 +35,6 @@ import './shortcuts_network';
 import './templates/issuable_template_selector';
 import './templates/issuable_template_selectors';
 
-// commit
-import './commit/file';
 import './commit/image_file';
 
 // lib/utils
@@ -70,7 +68,6 @@ import './build';
 import './build_artifacts';
 import './build_variables';
 import './ci_lint_editor';
-import './commit';
 import './commits';
 import './compare';
 import './compare_autocomplete';
diff --git a/app/assets/javascripts/merge_request_tabs.js b/app/assets/javascripts/merge_request_tabs.js
index d3299c15720..c042b22d1fd 100644
--- a/app/assets/javascripts/merge_request_tabs.js
+++ b/app/assets/javascripts/merge_request_tabs.js
@@ -13,6 +13,8 @@ import {
   isMetaClick,
 } from './lib/utils/common_utils';
 
+import initDiscussionTab from './image_diff/init_discussion_tab';
+
 /* eslint-disable max-len */
 // MergeRequestTabs
 //
@@ -154,6 +156,8 @@ import {
         }
         this.resetViewContainer();
         this.destroyPipelinesView();
+
+        initDiscussionTab();
       }
       if (this.setUrl) {
         this.setCurrentAction(action);
diff --git a/app/assets/javascripts/notes.js b/app/assets/javascripts/notes.js
index 93aa29454a0..24de21f2ce2 100644
--- a/app/assets/javascripts/notes.js
+++ b/app/assets/javascripts/notes.js
@@ -24,6 +24,7 @@ import './autosave';
 import './dropzone_input';
 import TaskList from './task_list';
 import { ajaxPost, isInViewport, getPagePath, scrollToElement, isMetaKey } from './lib/utils/common_utils';
+import imageDiffHelper from './image_diff/helpers/index';
 
 window.autosize = autosize;
 window.Dropzone = Dropzone;
@@ -42,6 +43,7 @@ export default class Notes {
     this.visibilityChange = this.visibilityChange.bind(this);
     this.cancelDiscussionForm = this.cancelDiscussionForm.bind(this);
     this.onAddDiffNote = this.onAddDiffNote.bind(this);
+    this.onAddImageDiffNote = this.onAddImageDiffNote.bind(this);
     this.setupDiscussionNoteForm = this.setupDiscussionNoteForm.bind(this);
     this.onReplyToDiscussionNote = this.onReplyToDiscussionNote.bind(this);
     this.removeNote = this.removeNote.bind(this);
@@ -114,6 +116,8 @@ export default class Notes {
     $(document).on('click', '.js-discussion-reply-button', this.onReplyToDiscussionNote);
     // add diff note
     $(document).on('click', '.js-add-diff-note-button', this.onAddDiffNote);
+    // add diff note for images
+    $(document).on('click', '.js-add-image-diff-note-button', this.onAddImageDiffNote);
     // hide diff note form
     $(document).on('click', '.js-close-discussion-note-form', this.cancelDiscussionForm);
     // toggle commit list
@@ -140,6 +144,7 @@ export default class Notes {
     $(document).off('click', '.js-note-attachment-delete');
     $(document).off('click', '.js-discussion-reply-button');
     $(document).off('click', '.js-add-diff-note-button');
+    $(document).off('click', '.js-add-image-diff-note-button');
     $(document).off('visibilitychange');
     $(document).off('keyup input', '.js-note-text');
     $(document).off('click', '.js-note-target-reopen');
@@ -412,6 +417,11 @@ export default class Notes {
     this.note_ids.push(noteEntity.id);
     form = $form || $(`.js-discussion-note-form[data-discussion-id="${noteEntity.discussion_id}"]`);
     row = form.closest('tr');
+
+    if (noteEntity.on_image) {
+      row = form;
+    }
+
     lineType = this.isParallelView() ? form.find('#line_type').val() : 'old';
     diffAvatarContainer = row.prevAll('.line_holder').first().find('.js-avatar-container.' + lineType + '_line');
     // is this the first note of discussion?
@@ -423,7 +433,7 @@ export default class Notes {
       if (noteEntity.diff_discussion_html) {
         var $discussion = $(noteEntity.diff_discussion_html).renderGFM();
 
-        if (!this.isParallelView() || row.hasClass('js-temp-notes-holder')) {
+        if (!this.isParallelView() || row.hasClass('js-temp-notes-holder') || noteEntity.on_image) {
           // insert the note and the reply button after the temp row
           row.after($discussion);
         } else {
@@ -449,6 +459,7 @@ export default class Notes {
 
     if (typeof gl.diffNotesCompileComponents !== 'undefined' && noteEntity.discussion_resolvable) {
       gl.diffNotesCompileComponents();
+
       this.renderDiscussionAvatar(diffAvatarContainer, noteEntity);
     }
 
@@ -561,7 +572,7 @@ export default class Notes {
       form.find('#note_line_code').val(),
 
       // DiffNote
-      form.find('#note_position').val()
+      form.find('#note_position').val(),
     ];
     return new Autosave(textarea, key);
   }
@@ -783,9 +794,22 @@ export default class Notes {
           $(`.js-diff-avatars-${discussionId}`).trigger('remove.vue');
 
           // The notes tr can contain multiple lists of notes, like on the parallel diff
-          if (notesTr.find('.discussion-notes').length > 1) {
+          // notesTr does not exist for image diffs
+          if (notesTr.find('.discussion-notes').length > 1 || notesTr.length === 0) {
+            const $diffFile = $notes.closest('.diff-file');
+            if ($diffFile.length > 0) {
+              const removeBadgeEvent = new CustomEvent('removeBadge.imageDiff', {
+                detail: {
+                  // badgeNumber's start with 1 and index starts with 0
+                  badgeNumber: $notes.index() + 1,
+                },
+              });
+
+              $diffFile[0].dispatchEvent(removeBadgeEvent);
+            }
+
             $notes.remove();
-          } else {
+          } else if (notesTr.length > 0) {
             notesTr.remove();
           }
         }
@@ -841,7 +865,11 @@ export default class Notes {
    */
   setupDiscussionNoteForm(dataHolder, form) {
     // setup note target
-    const diffFileData = dataHolder.closest('.text-file');
+    let diffFileData = dataHolder.closest('.text-file');
+
+    if (diffFileData.length === 0) {
+      diffFileData = dataHolder.closest('.image');
+    }
 
     var discussionID = dataHolder.data('discussionId');
 
@@ -907,6 +935,31 @@ export default class Notes {
     });
   }
 
+  onAddImageDiffNote(e) {
+    const $link = $(e.currentTarget || e.target);
+    const $diffFile = $link.closest('.diff-file');
+
+    const clickEvent = new CustomEvent('click.imageDiff', {
+      detail: e,
+    });
+
+    $diffFile[0].dispatchEvent(clickEvent);
+
+    // Setup comment form
+    let newForm;
+    const $noteContainer = $link.closest('.diff-viewer').find('.note-container');
+    const $form = $noteContainer.find('> .discussion-form');
+
+    if ($form.length === 0) {
+      newForm = this.cleanForm(this.formClone.clone());
+      newForm.appendTo($noteContainer);
+    } else {
+      newForm = $form;
+    }
+
+    this.setupDiscussionNoteForm($link, newForm);
+  }
+
   toggleDiffNote({
     target,
     lineType,
@@ -999,10 +1052,25 @@ export default class Notes {
   }
 
   cancelDiscussionForm(e) {
-    var form;
     e.preventDefault();
-    form = $(e.target).closest('.js-discussion-note-form');
-    return this.removeDiscussionNoteForm(form);
+    const $form = $(e.target).closest('.js-discussion-note-form');
+    const $discussionNote = $(e.target).closest('.discussion-notes');
+
+    if ($discussionNote.length === 0) {
+      // Only send blur event when the discussion form
+      // is not part of a discussion note
+      const $diffFile = $form.closest('.diff-file');
+
+      if ($diffFile.length > 0) {
+        const blurEvent = new CustomEvent('blur.imageDiff', {
+          detail: e,
+        });
+
+        $diffFile[0].dispatchEvent(blurEvent);
+      }
+    }
+
+    return this.removeDiscussionNoteForm($form);
   }
 
   /**
@@ -1414,6 +1482,15 @@ export default class Notes {
         // Submission successful! remove placeholder
         $notesContainer.find(`#${noteUniqueId}`).remove();
 
+        const $diffFile = $form.closest('.diff-file');
+        if ($diffFile.length > 0) {
+          const blurEvent = new CustomEvent('blur.imageDiff', {
+            detail: e,
+          });
+
+          $diffFile[0].dispatchEvent(blurEvent);
+        }
+
         // Reset cached commands list when command is applied
         if (hasQuickActions) {
           $form.find('textarea.js-note-text').trigger('clear-commands-cache.atwho');
@@ -1436,7 +1513,28 @@ export default class Notes {
           }
 
           // Show final note element on UI
-          this.addDiscussionNote($form, note, $notesContainer.length === 0);
+          const isNewDiffComment = $notesContainer.length === 0;
+          this.addDiscussionNote($form, note, isNewDiffComment);
+
+          if (isNewDiffComment) {
+            // Add image badge, avatar badge and toggle discussion badge for new image diffs
+            const notePosition = $form.find('#note_position').val();
+            if ($diffFile.length > 0 && notePosition.length > 0) {
+              const { x, y, width, height } = JSON.parse(notePosition);
+              const addBadgeEvent = new CustomEvent('addBadge.imageDiff', {
+                detail: {
+                  x,
+                  y,
+                  width,
+                  height,
+                  noteId: `note_${note.id}`,
+                  discussionId: note.discussion_id,
+                },
+              });
+
+              $diffFile[0].dispatchEvent(addBadgeEvent);
+            }
+          }
 
           // append flash-container to the Notes list
           if ($notesContainer.length) {
@@ -1457,6 +1555,16 @@ export default class Notes {
         // Submission failed, remove placeholder note and show Flash error message
         $notesContainer.find(`#${noteUniqueId}`).remove();
 
+        const blurEvent = new CustomEvent('blur.imageDiff', {
+          detail: e,
+        });
+
+        const closestDiffFile = $form.closest('.diff-file');
+
+        if (closestDiffFile.length) {
+          closestDiffFile[0].dispatchEvent(blurEvent);
+        }
+
         if (hasQuickActions) {
           $notesContainer.find(`#${systemNoteUniqueId}`).remove();
         }
@@ -1500,6 +1608,8 @@ export default class Notes {
     const $noteBody = $editingNote.find('.js-task-list-container');
     const $noteBodyText = $noteBody.find('.note-text');
     const { formData, formContent, formAction } = this.getFormData($form);
+    const $diffFile = $form.closest('.diff-file');
+    const $notesContainer = $form.closest('.notes');
 
     // Cache original comment content
     const cachedNoteBodyText = $noteBodyText.html();
diff --git a/app/assets/javascripts/single_file_diff.js b/app/assets/javascripts/single_file_diff.js
index 4505a79a2df..3f811c59cb9 100644
--- a/app/assets/javascripts/single_file_diff.js
+++ b/app/assets/javascripts/single_file_diff.js
@@ -1,6 +1,7 @@
 /* eslint-disable func-names, prefer-arrow-callback, space-before-function-paren, no-var, prefer-rest-params, wrap-iife, one-var, one-var-declaration-per-line, consistent-return, no-param-reassign, max-len */
 
 import FilesCommentButton from './files_comment_button';
+import imageDiffHelper from './image_diff/helpers/index';
 
 const WRAPPER = '<div class="diff-content"></div>';
 const LOADING_HTML = '<i class="fa fa-spinner fa-spin"></i>';
@@ -74,7 +75,11 @@ export default class SingleFileDiff {
           gl.diffNotesCompileComponents();
         }
 
-        FilesCommentButton.init($(_this.file));
+        const $file = $(_this.file);
+        FilesCommentButton.init($file);
+
+        const canCreateNote = $file.closest('.files').is('[data-can-create-note]');
+        imageDiffHelper.initImageDiff($file[0], canCreateNote);
 
         if (cb) cb();
       };
diff --git a/app/assets/stylesheets/framework/buttons.scss b/app/assets/stylesheets/framework/buttons.scss
index c77160a678b..b131e2d57ee 100644
--- a/app/assets/stylesheets/framework/buttons.scss
+++ b/app/assets/stylesheets/framework/buttons.scss
@@ -1,3 +1,25 @@
+@mixin btn-comment-icon {
+  border-radius: 50%;
+  background: $white-light;
+  padding: 1px 5px;
+  font-size: 12px;
+  color: $blue-500;
+  width: 23px;
+  height: 23px;
+  border: 1px solid $blue-500;
+
+  &:hover,
+  &.inverted {
+    background: $blue-500;
+    border-color: $blue-600;
+    color: $white-light;
+  }
+
+  &:active {
+    outline: 0;
+  }
+}
+
 @mixin btn-default {
   border-radius: 3px;
   font-size: $gl-font-size;
diff --git a/app/assets/stylesheets/framework/timeline.scss b/app/assets/stylesheets/framework/timeline.scss
index 3d68a50f91f..f718ec4bcad 100644
--- a/app/assets/stylesheets/framework/timeline.scss
+++ b/app/assets/stylesheets/framework/timeline.scss
@@ -17,15 +17,19 @@
 
   .diff-file {
     border: 1px solid $border-color;
-    border-bottom: none;
     margin: 0;
   }
+
+  &.text-file .diff-file {
+    border-bottom: none;
+  }
 }
 
 .timeline-entry {
   border-color: $white-normal;
   color: $gl-text-color;
   border-bottom: 1px solid $border-white-light;
+  background: $white-light;
 
   .timeline-entry-inner {
     position: relative;
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 2f9def51d91..5f604680181 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -323,6 +323,7 @@ $diff-image-info-color: grey;
 $diff-swipe-border: #999;
 $diff-view-modes-color: grey;
 $diff-view-modes-border: #c1c1c1;
+$diff-jagged-border-gradient-color: darken($white-normal, 8%);
 
 /*
  * Fonts
@@ -712,3 +713,9 @@ Issuable warning
 */
 $issuable-warning-size: 24px;
 $issuable-warning-icon-margin: 4px;
+
+/*
+Image Commenting cursor
+*/
+$image-comment-cursor-left-offset: 12;
+$image-comment-cursor-top-offset: 30;
diff --git a/app/assets/stylesheets/pages/diff.scss b/app/assets/stylesheets/pages/diff.scss
index fb23343b966..ffb5fc94475 100644
--- a/app/assets/stylesheets/pages/diff.scss
+++ b/app/assets/stylesheets/pages/diff.scss
@@ -297,6 +297,7 @@
         .drag-track {
           display: block;
           position: absolute;
+          top: 0;
           left: 12px;
           height: 10px;
           width: 276px;
@@ -547,16 +548,23 @@
 }
 
 .diff-notes-collapse {
-  width: 19px;
-  height: 19px;
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
   padding: 0;
   transition: transform .1s ease-out;
   z-index: 100;
 
+  .collapse-icon {
+    height: 50%;
+    width: 100%;
+  }
+
   svg {
-    vertical-align: text-top;
+    vertical-align: middle;
   }
 
+  .collapse-icon,
   path {
     fill: $white-light;
   }
@@ -644,3 +652,157 @@
   text-overflow: ellipsis;
   white-space: nowrap;
 }
+
+.note-container {
+  background-color: $gray-light;
+  border-top: 1px solid $white-normal;
+
+  // double jagged line divider
+  .discussion-notes + .discussion-notes::before,
+  .discussion-notes + .discussion-form::before {
+    content: '';
+    position: relative;
+    display: block;
+    width: 100%;
+    height: 10px;
+    background-color: $white-light;
+    background-image: linear-gradient(45deg, transparent, transparent 73%, $diff-jagged-border-gradient-color 75%, $white-light 80%),
+      linear-gradient(225deg, transparent, transparent 73%, $diff-jagged-border-gradient-color 75%, $white-light 80%),
+      linear-gradient(135deg, transparent, transparent 73%, $diff-jagged-border-gradient-color 75%, $white-light 80%),
+      linear-gradient(-45deg, transparent, transparent 73%, $diff-jagged-border-gradient-color 75%, $white-light 80%);
+    background-position: 5px 5px,0 5px,0 5px,5px 5px;
+    background-size: 10px 10px;
+    background-repeat: repeat;
+  }
+
+  .notes {
+    position: relative;
+  }
+
+  .diff-notes-collapse {
+    position: absolute;
+    left: -12px;
+  }
+}
+
+.diff-file .note-container > .new-note,
+.note-container .discussion-notes {
+  margin-left: 100px;
+  border-left: 1px solid $white-normal;
+}
+
+.notes.active {
+  .diff-file .note-container > .new-note,
+  .note-container .discussion-notes {
+    // Override our margin and border (set for diff tab)
+    // when user is on the discussion tab for MR
+    margin-left: inherit;
+    border-left: inherit;
+  }
+}
+
+.files:not([data-can-create-note]) .frame {
+  cursor: auto;
+}
+
+.frame.click-to-comment {
+  position: relative;
+  cursor: url(icon_image_comment.svg)
+    $image-comment-cursor-left-offset $image-comment-cursor-top-offset, auto;
+
+  // Retina cursor
+  cursor: -webkit-image-set(url(icon_image_comment.svg) 1x, url(icon_image_comment@2x.svg) 2x)
+    $image-comment-cursor-left-offset $image-comment-cursor-top-offset, auto;
+
+  .comment-indicator {
+    position: absolute;
+    padding: 0;
+    width: (2px * $image-comment-cursor-left-offset);
+    height: (1px * $image-comment-cursor-top-offset);
+    // center the indicator to match the top left click region
+    margin-top: (-1px * $image-comment-cursor-top-offset) + 2;
+    margin-left: (-1px * $image-comment-cursor-left-offset) + 1;
+
+    svg {
+      width: 100%;
+      height: 100%;
+    }
+
+    &:focus {
+      outline: none;
+    }
+  }
+}
+
+.frame .badge,
+.image-diff-avatar-link .badge,
+.notes > .badge {
+  position: absolute;
+  background-color: $blue-400;
+  color: $white-light;
+  border: $white-light 1px solid;
+  min-height: $gl-padding;
+  padding: 5px 8px;
+  border-radius: 12px;
+
+  &:focus {
+    outline: none;
+  }
+}
+
+.frame .badge,
+.frame .image-comment-badge {
+  // Center align badges on the frame
+  transform: translate3d(-50%, -50%, 0);
+}
+
+.image-comment-badge {
+  @include btn-comment-icon;
+  position: absolute;
+
+  &.inverted {
+    border-color: $white-light;
+  }
+}
+
+.image-diff-avatar-link {
+  position: relative;
+
+  .badge,
+  .image-comment-badge {
+    top: 25px;
+    right: 8px;
+  }
+}
+
+.notes > .badge {
+  display: none;
+  left: -13px;
+}
+
+.discussion-notes {
+  min-height: 35px;
+
+  &:first-child {
+    // First child does not have the jagged borders
+    min-height: 25px;
+  }
+
+  &.collapsed {
+    background-color: $white-light;
+
+    .diff-notes-collapse,
+    .note,
+    .discussion-reply-holder, {
+      display: none;
+    }
+
+    .notes > .badge {
+      display: block;
+    }
+  }
+}
+
+.discussion-body .image .frame {
+  position: relative;
+}
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index 420bca9ece5..04b132415eb 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -161,10 +161,13 @@
 }
 
 .discussion-form {
-  padding: $gl-padding-top $gl-padding $gl-padding;
   background-color: $white-light;
 }
 
+.discussion-form-container {
+  padding: $gl-padding-top $gl-padding $gl-padding;
+}
+
 .discussion-notes .disabled-comment {
   padding: 6px 0;
 }
diff --git a/app/assets/stylesheets/pages/notes.scss b/app/assets/stylesheets/pages/notes.scss
index 925fe4513ee..96b7db3b85d 100644
--- a/app/assets/stylesheets/pages/notes.scss
+++ b/app/assets/stylesheets/pages/notes.scss
@@ -650,29 +650,12 @@ ul.notes {
 }
 
 .add-diff-note {
+  @include btn-comment-icon;
   opacity: 0;
   margin-top: -2px;
-  border-radius: 50%;
-  background: $white-light;
-  padding: 1px 5px;
-  font-size: 12px;
-  color: $blue-500;
   margin-left: -55px;
   position: absolute;
   z-index: 10;
-  width: 23px;
-  height: 23px;
-  border: 1px solid $blue-500;
-
-  &:hover {
-    background: $blue-500;
-    border-color: $blue-600;
-    color: $white-light;
-  }
-
-  &:active {
-    outline: 0;
-  }
 }
 
 .discussion-body,
diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb
index 915f32b4c33..1126f706393 100644
--- a/app/controllers/concerns/notes_actions.rb
+++ b/app/controllers/concerns/notes_actions.rb
@@ -96,7 +96,8 @@ module NotesActions
           id: note.id,
           discussion_id: note.discussion_id(noteable),
           html: note_html(note),
-          note: note.note
+          note: note.note,
+          on_image: note.try(:on_image?)
         )
 
         discussion = note.to_discussion(noteable)
@@ -122,7 +123,9 @@ module NotesActions
   def diff_discussion_html(discussion)
     return unless discussion.diff_discussion?
 
-    if params[:view] == 'parallel'
+    on_image = discussion.on_image?
+
+    if params[:view] == 'parallel' && !on_image
       template = "discussions/_parallel_diff_discussion"
       locals =
         if params[:line_type] == 'old'
@@ -132,7 +135,9 @@ module NotesActions
         end
     else
       template = "discussions/_diff_discussion"
-      locals = { discussions: [discussion] }
+      @fresh_discussion = true
+
+      locals = { discussions: [discussion], on_image: on_image }
     end
 
     render_to_string(
diff --git a/app/models/concerns/discussion_on_diff.rb b/app/models/concerns/discussion_on_diff.rb
index eee1a36ac6b..f5cbb3becad 100644
--- a/app/models/concerns/discussion_on_diff.rb
+++ b/app/models/concerns/discussion_on_diff.rb
@@ -28,6 +28,10 @@ module DiscussionOnDiff
     true
   end
 
+  def file_new_path
+    first_note.position.new_path
+  end
+
   # Returns an array of at most 16 highlighted lines above a diff note
   def truncated_diff_lines(highlight: true)
     lines = highlight ? highlighted_diff_lines : diff_lines
diff --git a/app/models/diff_discussion.rb b/app/models/diff_discussion.rb
index 07c4846e2ac..6eba87da1a1 100644
--- a/app/models/diff_discussion.rb
+++ b/app/models/diff_discussion.rb
@@ -11,6 +11,8 @@ class DiffDiscussion < Discussion
   delegate  :position,
             :original_position,
             :change_position,
+            :on_text?,
+            :on_image?,
 
             to: :first_note
 
diff --git a/app/models/diff_note.rb b/app/models/diff_note.rb
index e9a60e6ce09..d88a92dc027 100644
--- a/app/models/diff_note.rb
+++ b/app/models/diff_note.rb
@@ -12,8 +12,8 @@ class DiffNote < Note
 
   validates :original_position, presence: true
   validates :position, presence: true
-  validates :diff_line, presence: true
-  validates :line_code, presence: true, line_code: true
+  validates :diff_line, presence: true, if: :on_text?
+  validates :line_code, presence: true, line_code: true, if: :on_text?
   validates :noteable_type, inclusion: { in: NOTEABLE_TYPES }
   validate :positions_complete
   validate :verify_supported
@@ -43,6 +43,14 @@ class DiffNote < Note
     end
   end
 
+  def on_text?
+    position.position_type == "text"
+  end
+
+  def on_image?
+    position.position_type == "image"
+  end
+
   def diff_file
     @diff_file ||= self.original_position.diff_file(self.project.repository)
   end
@@ -56,6 +64,8 @@ class DiffNote < Note
   end
 
   def original_line_code
+    return unless on_text?
+
     self.diff_file.line_code(self.diff_line)
   end
 
diff --git a/app/models/discussion.rb b/app/models/discussion.rb
index b80da7b246a..437df923d2d 100644
--- a/app/models/discussion.rb
+++ b/app/models/discussion.rb
@@ -66,6 +66,10 @@ class Discussion
     @context_noteable = context_noteable
   end
 
+  def on_image?
+    false
+  end
+
   def ==(other)
     other.class == self.class &&
       other.context_noteable == self.context_noteable &&
diff --git a/app/models/legacy_diff_discussion.rb b/app/models/legacy_diff_discussion.rb
index 3c1d34db5fa..80fc6304fd4 100644
--- a/app/models/legacy_diff_discussion.rb
+++ b/app/models/legacy_diff_discussion.rb
@@ -17,6 +17,14 @@ class LegacyDiffDiscussion < Discussion
     true
   end
 
+  def on_image?
+    false
+  end
+
+  def on_text?
+    true
+  end
+
   def active?(*args)
     return @active if @active.present?
 
diff --git a/app/models/note.rb b/app/models/note.rb
index f44590e2144..ceded9f2aef 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -134,14 +134,22 @@ class Note < ActiveRecord::Base
       Discussion.build(notes)
     end
 
+    # Group diff discussions by line code or file path.
+    # It is not needed to group by line code when comment is
+    # on an image.
     def grouped_diff_discussions(diff_refs = nil)
       groups = {}
 
       diff_notes.fresh.discussions.each do |discussion|
-        line_code = discussion.line_code_in_diffs(diff_refs)
-
-        if line_code
-          discussions = groups[line_code] ||= []
+        group_key =
+          if discussion.on_image?
+            discussion.file_new_path
+          else
+            discussion.line_code_in_diffs(diff_refs)
+          end
+
+        if group_key
+          discussions = groups[group_key] ||= []
           discussions << discussion
         end
       end
diff --git a/app/views/discussions/_diff_discussion.html.haml b/app/views/discussions/_diff_discussion.html.haml
index e6d307e5568..52279d0a870 100644
--- a/app/views/discussions/_diff_discussion.html.haml
+++ b/app/views/discussions/_diff_discussion.html.haml
@@ -1,6 +1,10 @@
-- expanded = local_assigns.fetch(:expanded, true)
-%tr.notes_holder{ class: ('hide' unless expanded) }
-  %td.notes_line{ colspan: 2 }
-  %td.notes_content
-    .content{ class: ('hide' unless expanded) }
-      = render partial: "discussions/notes", collection: discussions, as: :discussion
+- if local_assigns[:on_image]
+  = render partial: "discussions/notes", collection: discussions, as: :discussion
+- else
+  -# Text diff discussions
+  - expanded = local_assigns.fetch(:expanded, true)
+  %tr.notes_holder{ class: ('hide' unless expanded) }
+    %td.notes_line{ colspan: 2 }
+    %td.notes_content
+      .content{ class: ('hide' unless expanded) }
+        = render partial: "discussions/notes", collection: discussions, as: :discussion
diff --git a/app/views/discussions/_diff_with_notes.html.haml b/app/views/discussions/_diff_with_notes.html.haml
index 4a41be972da..636d06cab53 100644
--- a/app/views/discussions/_diff_with_notes.html.haml
+++ b/app/views/discussions/_diff_with_notes.html.haml
@@ -1,18 +1,27 @@
 - diff_file = discussion.diff_file
 - blob = discussion.blob
+- discussions = { discussion.original_line_code => [discussion] }
+- diff_file_class = diff_file.text? ? 'text-file' : 'js-image-file'
 
-.diff-file.file-holder
+.diff-file.file-holder{ class: diff_file_class }
   .js-file-title.file-title.file-title-flex-parent
     .file-header-content
       = render "projects/diffs/file_header", diff_file: diff_file, url: discussion_path(discussion), show_toggle: false
 
-  .diff-content.code.js-syntax-highlight
-    %table
-      - discussions = { discussion.original_line_code => [discussion] }
-      = render partial: "projects/diffs/line",
-        collection: discussion.truncated_diff_lines,
-        as: :line,
-        locals: { diff_file: diff_file,
-          discussions: discussions,
-          discussion_expanded: true,
-          plain: true }
+  - if diff_file.text?
+    .diff-content.code.js-syntax-highlight
+      %table
+        = render partial: "projects/diffs/line",
+          collection: discussion.truncated_diff_lines,
+          as: :line,
+          locals: { diff_file: diff_file,
+            discussions: discussions,
+            discussion_expanded: true,
+            plain: true }
+  - else
+    - partial = (diff_file.new_file? || diff_file.deleted_file?) ? 'single_image_diff' : 'replaced_image_diff'
+
+    = render partial: "projects/diffs/#{partial}", locals: { diff_file: diff_file, position: discussion.position.to_json, click_to_comment: false }
+
+    .note-container
+      = render partial: "discussions/notes", locals: { discussion: discussion, show_toggle: false, show_image_comment_badge: true, disable_collapse: true }
diff --git a/app/views/discussions/_notes.html.haml b/app/views/discussions/_notes.html.haml
index db5ab939948..9efcfef690f 100644
--- a/app/views/discussions/_notes.html.haml
+++ b/app/views/discussions/_notes.html.haml
@@ -1,6 +1,19 @@
-.discussion-notes
-  %ul.notes{ data: { discussion_id: discussion.id } }
-    = render partial: "shared/notes/note", collection: discussion.notes, as: :note
+- disable_collapse = local_assigns.fetch(:disable_collapse, false)
+- collapsed_class = 'collapsed' if discussion.resolved? && !disable_collapse
+- badge_counter = discussion_counter + 1 if local_assigns[:discussion_counter]
+- show_toggle = local_assigns.fetch(:show_toggle, true)
+- show_image_comment_badge = local_assigns.fetch(:show_image_comment_badge, false)
+
+.discussion-notes{ class: collapsed_class }
+  -# Save the first note position data so that we have a reference and can go
+  -# to the first note position when we click on a badge diff discussion
+  %ul.notes{ id: "discussion_#{discussion.id}", data: { discussion_id: discussion.id, position: discussion.notes[0].position.to_json } }
+    - if discussion.try(:on_image?) && show_toggle
+      %button.diff-notes-collapse.js-diff-notes-toggle{ type: 'button' }
+        = sprite_icon('collapse', css_class: 'collapse-icon')
+      %button.btn-transparent.badge.js-diff-notes-toggle{ type: 'button' }
+        = badge_counter
+    = render partial: "shared/notes/note", collection: discussion.notes, as: :note, locals: { badge_counter: badge_counter, show_image_comment_badge: show_image_comment_badge }
 
   .flash-container
 
diff --git a/app/views/projects/diffs/_image_diff_frame.html.haml b/app/views/projects/diffs/_image_diff_frame.html.haml
new file mode 100644
index 00000000000..dae73e10460
--- /dev/null
+++ b/app/views/projects/diffs/_image_diff_frame.html.haml
@@ -0,0 +1,5 @@
+- class_name = local_assigns.fetch(:class_name, '')
+- note_type = local_assigns.fetch(:note_type, '')
+
+.frame{ class: class_name, data: { position: position, note_type: note_type } }
+  = image_tag(image_path, alt: alt, draggable: false, lazy: false)
diff --git a/app/views/projects/diffs/_replaced_image_diff.html.haml b/app/views/projects/diffs/_replaced_image_diff.html.haml
new file mode 100644
index 00000000000..8fc232b464e
--- /dev/null
+++ b/app/views/projects/diffs/_replaced_image_diff.html.haml
@@ -0,0 +1,61 @@
+- blob = diff_file.blob
+- old_blob = diff_file.old_blob
+- blob_raw_path = diff_file_blob_raw_path(diff_file)
+- old_blob_raw_path = diff_file_old_blob_raw_path(diff_file)
+- click_to_comment = local_assigns.fetch(:click_to_comment, true)
+- diff_view_data = local_assigns.fetch(:diff_view_data, '')
+- class_name = ''
+
+- if click_to_comment
+  - class_name = 'js-add-image-diff-note-button click-to-comment'
+
+.image.js-replaced-image{ data: diff_view_data }
+  .two-up.view
+    .wrap
+      .frame.deleted
+        = image_tag(old_blob_raw_path, alt: diff_file.old_path, lazy: false)
+      %p.image-info.hide
+        %span.meta-filesize= number_to_human_size(old_blob.size)
+        |
+        %strong W:
+        %span.meta-width
+        |
+        %strong H:
+        %span.meta-height
+    .wrap
+      = render partial: "projects/diffs/image_diff_frame", locals: { class_name: "added js-image-frame #{class_name}", position: position, note_type: DiffNote.name, image_path: blob_raw_path, alt: diff_file.new_path }
+      %p.image-info.hide
+        %span.meta-filesize= number_to_human_size(blob.size)
+        |
+        %strong W:
+        %span.meta-width
+        |
+        %strong H:
+        %span.meta-height
+
+  .swipe.view.hide
+    .swipe-frame
+      .frame.deleted
+        = image_tag(old_blob_raw_path, alt: diff_file.old_path, lazy: false)
+      .swipe-wrap
+        = render partial: "projects/diffs/image_diff_frame", locals: { class_name: "added js-image-frame #{class_name}", position: position, note_type: DiffNote.name, image_path: blob_raw_path, alt: diff_file.new_path }
+      %span.swipe-bar
+        %span.top-handle
+        %span.bottom-handle
+
+  .onion-skin.view.hide
+    .onion-skin-frame
+      .frame.deleted
+        = image_tag(old_blob_raw_path, alt: diff_file.old_path, lazy: false)
+      = render partial: "projects/diffs/image_diff_frame", locals: { class_name: "added js-image-frame #{class_name}", position: position, note_type: DiffNote.name, image_path: blob_raw_path, alt: diff_file.new_path }
+      .controls
+        .transparent
+        .drag-track
+          .dragger{ :style => "left: 0px;" }
+        .opaque
+
+.view-modes.hide
+  %ul.view-modes-menu
+    %li.two-up{ data: { mode: 'two-up' } } 2-up
+    %li.swipe{ data: { mode: 'swipe' } } Swipe
+    %li.onion-skin{ data: { mode: 'onion-skin' } } Onion skin
diff --git a/app/views/projects/diffs/_single_image_diff.html.haml b/app/views/projects/diffs/_single_image_diff.html.haml
new file mode 100644
index 00000000000..6b0c6bbe48f
--- /dev/null
+++ b/app/views/projects/diffs/_single_image_diff.html.haml
@@ -0,0 +1,16 @@
+- blob = diff_file.blob
+- old_blob = diff_file.old_blob
+- blob_raw_path = diff_file_blob_raw_path(diff_file)
+- old_blob_raw_path = diff_file_old_blob_raw_path(diff_file)
+- click_to_comment = local_assigns.fetch(:click_to_comment, true)
+- diff_view_data = local_assigns.fetch(:diff_view_data, '')
+- class_name = ''
+
+- if click_to_comment
+  - class_name = 'js-add-image-diff-note-button click-to-comment'
+
+.image.js-single-image{ data: diff_view_data }
+  .wrap
+    - single_class_name = diff_file.deleted_file? ? 'deleted' : 'added'
+    = render partial: "projects/diffs/image_diff_frame", locals: { class_name: "#{single_class_name} #{class_name} js-image-frame", position: position, note_type: DiffNote.name, image_path: blob_raw_path, alt: diff_file.file_path }
+  %p.image-info= number_to_human_size(blob.size)
diff --git a/app/views/projects/diffs/viewers/_image.html.haml b/app/views/projects/diffs/viewers/_image.html.haml
index 6b5233833c6..f190073c2fc 100644
--- a/app/views/projects/diffs/viewers/_image.html.haml
+++ b/app/views/projects/diffs/viewers/_image.html.haml
@@ -1,67 +1,13 @@
 - diff_file = viewer.diff_file
-- blob = diff_file.blob
-- old_blob = diff_file.old_blob
-- blob_raw_path = diff_file_blob_raw_path(diff_file)
-- old_blob_raw_path = diff_file_old_blob_raw_path(diff_file)
+- image_point = Gitlab::Diff::ImagePoint.new(nil, nil, nil, nil)
+- discussions = @grouped_diff_discussions[diff_file.new_path] if @grouped_diff_discussions
+
+- locals = { diff_file: diff_file, position: diff_file.position(image_point, position_type: :image).to_json, click_to_comment: true, diff_view_data: diff_view_data }
 
 - if diff_file.new_file? || diff_file.deleted_file?
-  .image
-    %span.wrap
-      .frame{ class: (diff_file.deleted_file? ? 'deleted' : 'added') }
-        = image_tag(blob_raw_path, alt: diff_file.file_path)
-      %p.image-info= number_to_human_size(blob.size)
+  = render partial: "projects/diffs/single_image_diff", locals: locals
 - else
-  .image
-    .two-up.view
-      %span.wrap
-        .frame.deleted
-          = image_tag(old_blob_raw_path, alt: diff_file.old_path)
-        %p.image-info.hide
-          %span.meta-filesize= number_to_human_size(old_blob.size)
-          |
-          %b W:
-          %span.meta-width
-          |
-          %b H:
-          %span.meta-height
-      %span.wrap
-        .frame.added
-          = image_tag(blob_raw_path, alt: diff_file.new_path)
-        %p.image-info.hide
-          %span.meta-filesize= number_to_human_size(blob.size)
-          |
-          %b W:
-          %span.meta-width
-          |
-          %b H:
-          %span.meta-height
-
-    .swipe.view.hide
-      .swipe-frame
-        .frame.deleted
-          = image_tag(old_blob_raw_path, alt: diff_file.old_path, lazy: false)
-        .swipe-wrap
-          .frame.added
-            = image_tag(blob_raw_path, alt: diff_file.new_path, lazy: false)
-        %span.swipe-bar
-          %span.top-handle
-          %span.bottom-handle
-
-    .onion-skin.view.hide
-      .onion-skin-frame
-        .frame.deleted
-          = image_tag(old_blob_raw_path, alt: diff_file.old_path, lazy: false)
-        .frame.added
-          = image_tag(blob_raw_path, alt: diff_file.new_path, lazy: false)
-        .controls
-          .transparent
-          .drag-track
-            .dragger{ :style => "left: 0px;" }
-          .opaque
-
+  = render partial: "projects/diffs/replaced_image_diff", locals: locals
 
-  .view-modes.hide
-    %ul.view-modes-menu
-      %li.two-up{ data: { mode: 'two-up' } } 2-up
-      %li.swipe{ data: { mode: 'swipe' } } Swipe
-      %li.onion-skin{ data: { mode: 'onion-skin' } } Onion skin
+.note-container
+  = render partial: "discussions/notes", collection: discussions, as: :discussion
diff --git a/app/views/shared/notes/_form.html.haml b/app/views/shared/notes/_form.html.haml
index 725bf916592..71c0d740bc8 100644
--- a/app/views/shared/notes/_form.html.haml
+++ b/app/views/shared/notes/_form.html.haml
@@ -24,20 +24,21 @@
   -# DiffNote
   = f.hidden_field :position
 
-  = render layout: 'projects/md_preview', locals: { url: preview_url, referenced_users: true } do
-    = render 'projects/zen', f: f,
-      attr: :note,
-      classes: 'note-textarea js-note-text',
-      placeholder: "Write a comment or drag your files here...",
-      supports_quick_actions: supports_quick_actions,
-      supports_autocomplete: supports_autocomplete
-    = render 'shared/notes/hints', supports_quick_actions: supports_quick_actions
-    .error-alert
-
-  .note-form-actions.clearfix
-    = render partial: 'shared/notes/comment_button'
-
-    = yield(:note_actions)
-
-    %a.btn.btn-cancel.js-note-discard{ role: "button", data: {cancel_text: "Cancel" } }
-      Discard draft
+  .discussion-form-container
+    = render layout: 'projects/md_preview', locals: { url: preview_url, referenced_users: true } do
+      = render 'projects/zen', f: f,
+        attr: :note,
+        classes: 'note-textarea js-note-text',
+        placeholder: "Write a comment or drag your files here...",
+        supports_quick_actions: supports_quick_actions,
+        supports_autocomplete: supports_autocomplete
+      = render 'shared/notes/hints', supports_quick_actions: supports_quick_actions
+      .error-alert
+
+    .note-form-actions.clearfix
+      = render partial: 'shared/notes/comment_button'
+
+      = yield(:note_actions)
+
+      %a.btn.btn-cancel.js-note-discard{ role: "button", data: {cancel_text: "Cancel" } }
+        Discard draft
diff --git a/app/views/shared/notes/_note.html.haml b/app/views/shared/notes/_note.html.haml
index 4f00a9f2759..b6085fd3af0 100644
--- a/app/views/shared/notes/_note.html.haml
+++ b/app/views/shared/notes/_note.html.haml
@@ -1,7 +1,10 @@
 - return unless note.author
 - return if note.cross_reference_not_visible_for?(current_user)
 
+- show_image_comment_badge = local_assigns.fetch(:show_image_comment_badge, false)
 - note_editable = note_editable?(note)
+- note_counter = local_assigns.fetch(:note_counter, 0)
+
 %li.timeline-entry{ id: dom_id(note),
   class: ["note", "note-row-#{note.id}", ('system-note' if note.system)],
   data: { author_id: note.author.id,
@@ -12,8 +15,18 @@
       - if note.system
         = icon_for_system_note(note)
       - else
-        %a{ href: user_path(note.author) }
+        %a.image-diff-avatar-link{ href: user_path(note.author) }
           = image_tag avatar_icon(note.author), alt: '', class: 'avatar s40'
+          - if note.is_a?(DiffNote) && note.on_image?
+            - if show_image_comment_badge && note_counter == 0
+              -# Only show this for the first comment in the discussion
+              %span.image-comment-badge.inverted
+                = icon('comment-o')
+            - elsif note_counter == 0
+              - counter = badge_counter if local_assigns[:badge_counter]
+              - badge_class = "hidden" if @fresh_discussion || counter.nil?
+              %span.badge{ class: badge_class }
+                = counter
     .timeline-content
       .note-header
         .note-header-info
diff --git a/changelogs/unreleased/issue_35873.yml b/changelogs/unreleased/issue_35873.yml
new file mode 100644
index 00000000000..65064b97e56
--- /dev/null
+++ b/changelogs/unreleased/issue_35873.yml
@@ -0,0 +1,5 @@
+---
+title: Commenting on image diffs
+merge_request: 14061
+author:
+type: added
diff --git a/lib/gitlab/diff/file.rb b/lib/gitlab/diff/file.rb
index fcac85ff892..599c3c5deab 100644
--- a/lib/gitlab/diff/file.rb
+++ b/lib/gitlab/diff/file.rb
@@ -27,16 +27,23 @@ module Gitlab
         @fallback_diff_refs = fallback_diff_refs
       end
 
-      def position(line)
+      def position(position_marker, position_type: :text)
         return unless diff_refs
 
-        Position.new(
+        data = {
+          diff_refs: diff_refs,
+          position_type: position_type.to_s,
           old_path: old_path,
-          new_path: new_path,
-          old_line: line.old_line,
-          new_line: line.new_line,
-          diff_refs: diff_refs
-        )
+          new_path: new_path
+        }
+
+        if position_type == :text
+          data.merge!(text_position_properties(position_marker))
+        else
+          data.merge!(image_position_properties(position_marker))
+        end
+
+        Position.new(data)
       end
 
       def line_code(line)
@@ -228,6 +235,14 @@ module Gitlab
 
       private
 
+      def text_position_properties(line)
+        { old_line: line.old_line, new_line: line.new_line }
+      end
+
+      def image_position_properties(image_point)
+        image_point.to_h
+      end
+
       def blobs_changed?
         old_blob && new_blob && old_blob.id != new_blob.id
       end
diff --git a/lib/gitlab/diff/formatters/base_formatter.rb b/lib/gitlab/diff/formatters/base_formatter.rb
new file mode 100644
index 00000000000..5e923b9e602
--- /dev/null
+++ b/lib/gitlab/diff/formatters/base_formatter.rb
@@ -0,0 +1,61 @@
+module Gitlab
+  module Diff
+    module Formatters
+      class BaseFormatter
+        attr_reader :old_path
+        attr_reader :new_path
+        attr_reader :base_sha
+        attr_reader :start_sha
+        attr_reader :head_sha
+        attr_reader :position_type
+
+        def initialize(attrs)
+          if diff_file = attrs[:diff_file]
+            attrs[:diff_refs] = diff_file.diff_refs
+            attrs[:old_path] = diff_file.old_path
+            attrs[:new_path] = diff_file.new_path
+          end
+
+          if diff_refs = attrs[:diff_refs]
+            attrs[:base_sha] = diff_refs.base_sha
+            attrs[:start_sha] = diff_refs.start_sha
+            attrs[:head_sha]  = diff_refs.head_sha
+          end
+
+          @old_path = attrs[:old_path]
+          @new_path = attrs[:new_path]
+          @base_sha = attrs[:base_sha]
+          @start_sha = attrs[:start_sha]
+          @head_sha  = attrs[:head_sha]
+        end
+
+        def key
+          [base_sha, start_sha, head_sha, Digest::SHA1.hexdigest(old_path || ""), Digest::SHA1.hexdigest(new_path || "")]
+        end
+
+        def to_h
+          {
+            base_sha: base_sha,
+            start_sha: start_sha,
+            head_sha: head_sha,
+            old_path: old_path,
+            new_path: new_path,
+            position_type: position_type
+          }
+        end
+
+        def position_type
+          raise NotImplementedError
+        end
+
+        def ==(other)
+          raise NotImplementedError
+        end
+
+        def complete?
+          raise NotImplementedError
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/diff/formatters/image_formatter.rb b/lib/gitlab/diff/formatters/image_formatter.rb
new file mode 100644
index 00000000000..ccd0d309972
--- /dev/null
+++ b/lib/gitlab/diff/formatters/image_formatter.rb
@@ -0,0 +1,43 @@
+module Gitlab
+  module Diff
+    module Formatters
+      class ImageFormatter < BaseFormatter
+        attr_reader :width
+        attr_reader :height
+        attr_reader :x
+        attr_reader :y
+
+        def initialize(attrs)
+          @x = attrs[:x]
+          @y = attrs[:y]
+          @width = attrs[:width]
+          @height = attrs[:height]
+
+          super(attrs)
+        end
+
+        def key
+          @key ||= super.push(x, y)
+        end
+
+        def complete?
+          x && y && width && height
+        end
+
+        def to_h
+          super.merge(width: width, height: height, x: x, y: y)
+        end
+
+        def position_type
+          "image"
+        end
+
+        def ==(other)
+          other.is_a?(self.class) &&
+            x == other.x &&
+            y == other.y
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/diff/formatters/text_formatter.rb b/lib/gitlab/diff/formatters/text_formatter.rb
new file mode 100644
index 00000000000..01c7e9f51ab
--- /dev/null
+++ b/lib/gitlab/diff/formatters/text_formatter.rb
@@ -0,0 +1,49 @@
+module Gitlab
+  module Diff
+    module Formatters
+      class TextFormatter < BaseFormatter
+        attr_reader :old_line
+        attr_reader :new_line
+
+        def initialize(attrs)
+          @old_line = attrs[:old_line]
+          @new_line = attrs[:new_line]
+
+          super(attrs)
+        end
+
+        def key
+          @key ||= super.push(old_line, new_line)
+        end
+
+        def complete?
+          old_line || new_line
+        end
+
+        def to_h
+          super.merge(old_line: old_line, new_line: new_line)
+        end
+
+        def line_age
+          if old_line && new_line
+            nil
+          elsif new_line
+            'new'
+          else
+            'old'
+          end
+        end
+
+        def position_type
+          "text"
+        end
+
+        def ==(other)
+          other.is_a?(self.class) &&
+            new_line == other.new_line &&
+            old_line == other.old_line
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/diff/image_point.rb b/lib/gitlab/diff/image_point.rb
new file mode 100644
index 00000000000..65332dfd239
--- /dev/null
+++ b/lib/gitlab/diff/image_point.rb
@@ -0,0 +1,23 @@
+module Gitlab
+  module Diff
+    class ImagePoint
+      attr_reader :width, :height, :x, :y
+
+      def initialize(width, height, x, y)
+        @width = width
+        @height = height
+        @x = x
+        @y = y
+      end
+
+      def to_h
+        {
+          width: width,
+          height: height,
+          x: x,
+          y: y
+        }
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/diff/position.rb b/lib/gitlab/diff/position.rb
index b8db3adef0a..bd0a9502a5e 100644
--- a/lib/gitlab/diff/position.rb
+++ b/lib/gitlab/diff/position.rb
@@ -1,37 +1,25 @@
-# Defines a specific location, identified by paths and line numbers,
+# Defines a specific location, identified by paths line numbers and image coordinates,
 # within a specific diff, identified by start, head and base commit ids.
 module Gitlab
   module Diff
     class Position
-      attr_reader :old_path
-      attr_reader :new_path
-      attr_reader :old_line
-      attr_reader :new_line
-      attr_reader :base_sha
-      attr_reader :start_sha
-      attr_reader :head_sha
-
+      attr_accessor :formatter
+
+      delegate :old_path,
+               :new_path,
+               :base_sha,
+               :start_sha,
+               :head_sha,
+               :old_line,
+               :new_line,
+               :position_type, to: :formatter
+
+      # A position can belong to a text line or to an image coordinate
+      # it depends of the position_type argument.
+      # Text position will have: new_line and old_line
+      # Image position will have: width, height, x, y
       def initialize(attrs = {})
-        if diff_file = attrs[:diff_file]
-          attrs[:diff_refs] = diff_file.diff_refs
-          attrs[:old_path] = diff_file.old_path
-          attrs[:new_path] = diff_file.new_path
-        end
-
-        if diff_refs = attrs[:diff_refs]
-          attrs[:base_sha]  = diff_refs.base_sha
-          attrs[:start_sha] = diff_refs.start_sha
-          attrs[:head_sha]  = diff_refs.head_sha
-        end
-
-        @old_path = attrs[:old_path]
-        @new_path = attrs[:new_path]
-        @base_sha  = attrs[:base_sha]
-        @start_sha = attrs[:start_sha]
-        @head_sha  = attrs[:head_sha]
-
-        @old_line = attrs[:old_line]
-        @new_line = attrs[:new_line]
+        @formatter = get_formatter_class(attrs[:position_type]).new(attrs)
       end
 
       # `Gitlab::Diff::Position` objects are stored as serialized attributes in
@@ -46,7 +34,11 @@ module Gitlab
       end
 
       def encode_with(coder)
-        coder['attributes'] = self.to_h
+        coder['attributes'] = formatter.to_h
+      end
+
+      def key
+        formatter.key
       end
 
       def ==(other)
@@ -54,20 +46,11 @@ module Gitlab
           other.diff_refs == diff_refs &&
           other.old_path == old_path &&
           other.new_path == new_path &&
-          other.old_line == old_line &&
-          other.new_line == new_line
+          other.formatter == formatter
       end
 
       def to_h
-        {
-          old_path: old_path,
-          new_path: new_path,
-          old_line: old_line,
-          new_line: new_line,
-          base_sha:  base_sha,
-          start_sha: start_sha,
-          head_sha:  head_sha
-        }
+        formatter.to_h
       end
 
       def inspect
@@ -75,23 +58,15 @@ module Gitlab
       end
 
       def complete?
-        file_path.present? &&
-          (old_line || new_line) &&
-          diff_refs.complete?
+        file_path.present? && formatter.complete? && diff_refs.complete?
       end
 
       def to_json(opts = nil)
-        JSON.generate(self.to_h, opts)
+        JSON.generate(formatter.to_h, opts)
       end
 
       def type
-        if old_line && new_line
-          nil
-        elsif new_line
-          'new'
-        else
-          'old'
-        end
+        formatter.line_age
       end
 
       def unchanged?
@@ -150,6 +125,17 @@ module Gitlab
 
         diff_refs.compare_in(repository.project).diffs(paths: paths, expanded: true).diff_files.first
       end
+
+      def get_formatter_class(type)
+        type ||= "text"
+
+        case type
+        when 'image'
+          Gitlab::Diff::Formatters::ImageFormatter
+        else
+          Gitlab::Diff::Formatters::TextFormatter
+        end
+      end
     end
   end
 end
diff --git a/spec/factories/merge_requests.rb b/spec/factories/merge_requests.rb
index cbec716d6ea..2c732aaf4ed 100644
--- a/spec/factories/merge_requests.rb
+++ b/spec/factories/merge_requests.rb
@@ -22,6 +22,11 @@ FactoryGirl.define do
     trait :with_diffs do
     end
 
+    trait :with_image_diffs do
+      source_branch "add_images_and_changes"
+      target_branch "master"
+    end
+
     trait :without_diffs do
       source_branch "improve/awesome"
       target_branch "master"
diff --git a/spec/features/merge_requests/diffs_spec.rb b/spec/features/merge_requests/diffs_spec.rb
index e9068f722d5..f4ba660ca39 100644
--- a/spec/features/merge_requests/diffs_spec.rb
+++ b/spec/features/merge_requests/diffs_spec.rb
@@ -42,8 +42,12 @@ feature 'Diffs URL', js: true do
         visit "#{diffs_project_merge_request_path(project, merge_request)}#{fragment}"
       end
 
-      it 'shows expanded note' do
-        expect(page).to have_selector(fragment, visible: true)
+      it 'shows collapsed note' do
+        wait_for_requests
+
+        expect(page).to have_selector('.discussion-notes.collapsed') do |note_container|
+          expect(note_container).to have_selector(fragment, visible: false)
+        end
       end
     end
   end
diff --git a/spec/features/merge_requests/image_diff_notes.rb b/spec/features/merge_requests/image_diff_notes.rb
new file mode 100644
index 00000000000..e8ca8a98d70
--- /dev/null
+++ b/spec/features/merge_requests/image_diff_notes.rb
@@ -0,0 +1,196 @@
+require 'spec_helper'
+
+feature 'image diff notes', js: true do
+  include NoteInteractionHelpers
+
+  let(:user) { create(:user) }
+  let(:project) { create(:project, :public, :repository) }
+
+  before do
+    project.team << [user, :master]
+    sign_in user
+
+    page.driver.set_cookie('sidebar_collapsed', 'true')
+
+    # Stub helper to return any blob file as image from public app folder.
+    # This is necessary to run this specs since we don't display repo images in capybara.
+    allow_any_instance_of(DiffHelper).to receive(:diff_file_blob_raw_path).and_return('/apple-touch-icon.png')
+  end
+
+  context 'create commit diff notes' do
+    commit_id = '2f63565e7aac07bcdadb654e253078b727143ec4'
+
+    describe 'create a new diff note' do
+      before do
+        visit project_commit_path(project, commit_id)
+        create_image_diff_note
+      end
+
+      it 'shows indicator badge on image diff' do
+        indicator = find('.js-image-badge')
+
+        expect(indicator).to have_content('1')
+      end
+
+      it 'shows the avatar badge on the new note' do
+        badge = find('.image-diff-avatar-link .badge')
+
+        expect(badge).to have_content('1')
+      end
+
+      it 'allows collapsing/expanding the discussion notes' do
+        find('.js-diff-notes-toggle', :first).click
+
+        expect(page).not_to have_content('image diff test comment')
+
+        find('.js-diff-notes-toggle').click
+
+        expect(page).to have_content('image diff test comment')
+      end
+    end
+
+    describe 'render commit diff notes' do
+      let(:path) { "files/images/6049019_460s.jpg" }
+      let(:commit) { project.commit('2f63565e7aac07bcdadb654e253078b727143ec4') }
+
+      let(:note1_position) do
+        Gitlab::Diff::Position.new(
+          old_path: path,
+          new_path: path,
+          width: 100,
+          height: 100,
+          x: 10,
+          y: 10,
+          position_type: "image",
+          diff_refs: commit.diff_refs
+        )
+      end
+
+      let(:note2_position) do
+        Gitlab::Diff::Position.new(
+          old_path: path,
+          new_path: path,
+          width: 100,
+          height: 100,
+          x: 20,
+          y: 20,
+          position_type: "image",
+          diff_refs: commit.diff_refs
+        )
+      end
+
+      let!(:note1) { create(:diff_note_on_commit, commit_id: commit.id, project: project, position: note1_position, note: 'my note 1') }
+      let!(:note2) { create(:diff_note_on_commit, commit_id: commit.id, project: project, position: note2_position, note: 'my note 2') }
+
+      before do
+        visit project_commit_path(project, commit.id)
+        wait_for_requests
+      end
+
+      it 'render diff indicators within the image diff frame' do
+        expect(page).to have_css('.js-image-badge', count: 2)
+      end
+
+      it 'shows the diff notes' do
+        expect(page).to have_css('.diff-content .note', count: 2)
+      end
+
+      it 'shows the diff notes with correct avatar badge numbers' do
+        expect(page).to have_css('.image-diff-avatar-link', text: 1)
+        expect(page).to have_css('.image-diff-avatar-link', text: 2)
+      end
+    end
+  end
+
+  %w(inline parallel).each do |view|
+    context "#{view} view" do
+      let(:merge_request) { create(:merge_request_with_diffs, :with_image_diffs, source_project: project, author: user) }
+      let(:path)          { "files/images/ee_repo_logo.png" }
+
+      let(:position) do
+        Gitlab::Diff::Position.new(
+          old_path: path,
+          new_path: path,
+          width: 100,
+          height: 100,
+          x: 1,
+          y: 1,
+          position_type: "image",
+          diff_refs: merge_request.diff_refs
+        )
+      end
+
+      let!(:note) { create(:diff_note_on_merge_request, project: project, noteable: merge_request, position: position) }
+
+      describe 'creating a new diff note' do
+        before do
+          visit diffs_project_merge_request_path(project, merge_request, view: view)
+          create_image_diff_note
+        end
+
+        it 'shows indicator badge on image diff' do
+          indicator = find('.js-image-badge', match: :first)
+
+          expect(indicator).to have_content('1')
+        end
+
+        it 'shows the avatar badge on the new note' do
+          badge = find('.image-diff-avatar-link .badge', match: :first)
+
+          expect(badge).to have_content('1')
+        end
+
+        it 'allows expanding/collapsing the discussion notes' do
+          page.all('.js-diff-notes-toggle')[0].trigger('click')
+          page.all('.js-diff-notes-toggle')[1].trigger('click')
+
+          expect(page).not_to have_content('image diff test comment')
+
+          page.all('.js-diff-notes-toggle')[0].trigger('click')
+          page.all('.js-diff-notes-toggle')[1].trigger('click')
+
+          expect(page).to have_content('image diff test comment')
+        end
+      end
+    end
+  end
+
+  describe 'discussion tab polling', :js do
+    let(:merge_request) { create(:merge_request_with_diffs, :with_image_diffs, source_project: project, author: user) }
+    let(:path)          { "files/images/ee_repo_logo.png" }
+
+    let(:position) do
+      Gitlab::Diff::Position.new(
+        old_path: path,
+        new_path: path,
+        width: 100,
+        height: 100,
+        x: 50,
+        y: 50,
+        position_type: "image",
+        diff_refs: merge_request.diff_refs
+      )
+    end
+
+    before do
+      visit project_merge_request_path(project, merge_request)
+    end
+
+    it 'render diff indicators within the image frame' do
+      diff_note = create(:diff_note_on_merge_request, project: project, noteable: merge_request, position: position)
+
+      wait_for_requests
+
+      expect(page).to have_selector('.image-comment-badge')
+      expect(page).to have_content(diff_note.note)
+    end
+  end
+end
+
+def create_image_diff_note
+  find('.js-add-image-diff-note-button', match: :first).click
+  page.all('.js-add-image-diff-note-button')[0].trigger('click')
+  find('.diff-content .note-textarea').native.send_keys('image diff test comment')
+  click_button 'Comment'
+  wait_for_requests
+end
diff --git a/spec/features/merge_requests/user_posts_diff_notes_spec.rb b/spec/features/merge_requests/user_posts_diff_notes_spec.rb
index e1ca4fe186c..7a773fb2baa 100644
--- a/spec/features/merge_requests/user_posts_diff_notes_spec.rb
+++ b/spec/features/merge_requests/user_posts_diff_notes_spec.rb
@@ -227,6 +227,7 @@ feature 'Merge requests > User posts diff notes', :js do
     write_comment_on_line(line_holder, diff_side)
 
     click_button 'Comment'
+
     wait_for_requests
 
     assert_comment_persistence(line_holder, asset_form_reset: asset_form_reset)
diff --git a/spec/javascripts/image_diff/helpers/badge_helper_spec.js b/spec/javascripts/image_diff/helpers/badge_helper_spec.js
new file mode 100644
index 00000000000..fb9c7e59031
--- /dev/null
+++ b/spec/javascripts/image_diff/helpers/badge_helper_spec.js
@@ -0,0 +1,132 @@
+import * as badgeHelper from '~/image_diff/helpers/badge_helper';
+import * as mockData from '../mock_data';
+
+describe('badge helper', () => {
+  const { coordinate, noteId, badgeText, badgeNumber } = mockData;
+  let containerEl;
+  let buttonEl;
+
+  beforeEach(() => {
+    containerEl = document.createElement('div');
+  });
+
+  describe('createImageBadge', () => {
+    beforeEach(() => {
+      buttonEl = badgeHelper.createImageBadge(noteId, coordinate);
+    });
+
+    it('should create button', () => {
+      expect(buttonEl.tagName).toEqual('BUTTON');
+      expect(buttonEl.getAttribute('type')).toEqual('button');
+    });
+
+    it('should set disabled attribute', () => {
+      expect(buttonEl.hasAttribute('disabled')).toEqual(true);
+    });
+
+    it('should set noteId', () => {
+      expect(buttonEl.dataset.noteId).toEqual(noteId);
+    });
+
+    it('should set coordinate', () => {
+      expect(buttonEl.style.left).toEqual(`${coordinate.x}px`);
+      expect(buttonEl.style.top).toEqual(`${coordinate.y}px`);
+    });
+
+    describe('classNames', () => {
+      it('should set .js-image-badge by default', () => {
+        expect(buttonEl.className).toEqual('js-image-badge');
+      });
+
+      it('should add additional class names if parameter is passed', () => {
+        const classNames = ['first-class', 'second-class'];
+        buttonEl = badgeHelper.createImageBadge(noteId, coordinate, classNames);
+
+        expect(buttonEl.className).toEqual(classNames.concat('js-image-badge').join(' '));
+      });
+    });
+  });
+
+  describe('addImageBadge', () => {
+    beforeEach(() => {
+      badgeHelper.addImageBadge(containerEl, {
+        coordinate,
+        badgeText,
+        noteId,
+      });
+      buttonEl = containerEl.querySelector('button');
+    });
+
+    it('should appends button to container', () => {
+      expect(buttonEl).toBeDefined();
+    });
+
+    it('should set the badge text', () => {
+      expect(buttonEl.innerText).toEqual(badgeText);
+    });
+
+    it('should set the button coordinates', () => {
+      expect(buttonEl.style.left).toEqual(`${coordinate.x}px`);
+      expect(buttonEl.style.top).toEqual(`${coordinate.y}px`);
+    });
+
+    it('should set the button noteId', () => {
+      expect(buttonEl.dataset.noteId).toEqual(noteId);
+    });
+  });
+
+  describe('addImageCommentBadge', () => {
+    beforeEach(() => {
+      badgeHelper.addImageCommentBadge(containerEl, {
+        coordinate,
+        noteId,
+      });
+      buttonEl = containerEl.querySelector('button');
+    });
+
+    it('should append icon button to container', () => {
+      expect(buttonEl).toBeDefined();
+    });
+
+    it('should create icon comment button', () => {
+      const iconEl = buttonEl.querySelector('i');
+      expect(iconEl).toBeDefined();
+      expect(iconEl.classList.contains('fa')).toEqual(true);
+      expect(iconEl.classList.contains('fa-comment-o')).toEqual(true);
+    });
+
+    it('should have .image-comment-badge.inverted in button class', () => {
+      expect(buttonEl.classList.contains('image-comment-badge')).toEqual(true);
+      expect(buttonEl.classList.contains('inverted')).toEqual(true);
+    });
+  });
+
+  describe('addAvatarBadge', () => {
+    let avatarBadgeEl;
+
+    beforeEach(() => {
+      containerEl.innerHTML = `
+        <div id="${noteId}">
+          <div class="badge hidden">
+          </div>
+        </div>
+      `;
+
+      badgeHelper.addAvatarBadge(containerEl, {
+        detail: {
+          noteId,
+          badgeNumber,
+        },
+      });
+      avatarBadgeEl = containerEl.querySelector(`#${noteId} .badge`);
+    });
+
+    it('should update badge number', () => {
+      expect(avatarBadgeEl.innerText).toEqual(badgeNumber.toString());
+    });
+
+    it('should remove hidden class', () => {
+      expect(avatarBadgeEl.classList.contains('hidden')).toEqual(false);
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/helpers/comment_indicator_helper_spec.js b/spec/javascripts/image_diff/helpers/comment_indicator_helper_spec.js
new file mode 100644
index 00000000000..a284b981d2a
--- /dev/null
+++ b/spec/javascripts/image_diff/helpers/comment_indicator_helper_spec.js
@@ -0,0 +1,139 @@
+import * as commentIndicatorHelper from '~/image_diff/helpers/comment_indicator_helper';
+import * as mockData from '../mock_data';
+
+describe('commentIndicatorHelper', () => {
+  const { coordinate } = mockData;
+  let containerEl;
+
+  beforeEach(() => {
+    containerEl = document.createElement('div');
+  });
+
+  describe('addCommentIndicator', () => {
+    let buttonEl;
+
+    beforeEach(() => {
+      commentIndicatorHelper.addCommentIndicator(containerEl, coordinate);
+      buttonEl = containerEl.querySelector('button');
+    });
+
+    it('should append button to container', () => {
+      expect(buttonEl).toBeDefined();
+    });
+
+    describe('button', () => {
+      it('should set coordinate', () => {
+        expect(buttonEl.style.left).toEqual(`${coordinate.x}px`);
+        expect(buttonEl.style.top).toEqual(`${coordinate.y}px`);
+      });
+
+      it('should contain image-comment-dark svg', () => {
+        const svgEl = buttonEl.querySelector('svg');
+        expect(svgEl).toBeDefined();
+
+        const svgLink = svgEl.querySelector('use').getAttribute('xlink:href');
+        expect(svgLink.indexOf('image-comment-dark') !== -1).toEqual(true);
+      });
+    });
+  });
+
+  describe('removeCommentIndicator', () => {
+    it('should return removed false if there is no comment-indicator', () => {
+      const result = commentIndicatorHelper.removeCommentIndicator(containerEl);
+      expect(result.removed).toEqual(false);
+    });
+
+    describe('has comment indicator', () => {
+      let result;
+
+      beforeEach(() => {
+        containerEl.innerHTML = `
+          <div class="comment-indicator" style="left:${coordinate.x}px; top: ${coordinate.y}px;">
+            <img src="${gl.TEST_HOST}/image.png">
+          </div>
+        `;
+        result = commentIndicatorHelper.removeCommentIndicator(containerEl);
+      });
+
+      it('should remove comment indicator', () => {
+        expect(containerEl.querySelector('.comment-indicator')).toBeNull();
+      });
+
+      it('should return removed true', () => {
+        expect(result.removed).toEqual(true);
+      });
+
+      it('should return indicator meta', () => {
+        expect(result.x).toEqual(coordinate.x);
+        expect(result.y).toEqual(coordinate.y);
+        expect(result.image).toBeDefined();
+        expect(result.image.width).toBeDefined();
+        expect(result.image.height).toBeDefined();
+      });
+    });
+  });
+
+  describe('showCommentIndicator', () => {
+    describe('commentIndicator exists', () => {
+      beforeEach(() => {
+        containerEl.innerHTML = `
+          <button class="comment-indicator"></button>
+        `;
+        commentIndicatorHelper.showCommentIndicator(containerEl, coordinate);
+      });
+
+      it('should set commentIndicator coordinates', () => {
+        const commentIndicatorEl = containerEl.querySelector('.comment-indicator');
+        expect(commentIndicatorEl.style.left).toEqual(`${coordinate.x}px`);
+        expect(commentIndicatorEl.style.top).toEqual(`${coordinate.y}px`);
+      });
+    });
+
+    describe('commentIndicator does not exist', () => {
+      beforeEach(() => {
+        commentIndicatorHelper.showCommentIndicator(containerEl, coordinate);
+      });
+
+      it('should addCommentIndicator', () => {
+        const buttonEl = containerEl.querySelector('.comment-indicator');
+        expect(buttonEl).toBeDefined();
+        expect(buttonEl.style.left).toEqual(`${coordinate.x}px`);
+        expect(buttonEl.style.top).toEqual(`${coordinate.y}px`);
+      });
+    });
+  });
+
+  describe('commentIndicatorOnClick', () => {
+    let event;
+    let textAreaEl;
+
+    beforeEach(() => {
+      containerEl.innerHTML = `
+        <div class="diff-viewer">
+          <button></button>
+          <div class="note-container">
+            <textarea class="note-textarea"></textarea>
+          </div>
+        </div>
+      `;
+      textAreaEl = containerEl.querySelector('textarea');
+
+      event = {
+        stopPropagation: () => {},
+        currentTarget: containerEl.querySelector('button'),
+      };
+
+      spyOn(event, 'stopPropagation');
+      spyOn(textAreaEl, 'focus');
+      commentIndicatorHelper.commentIndicatorOnClick(event);
+    });
+
+    it('should stopPropagation', () => {
+      expect(event.stopPropagation).toHaveBeenCalled();
+    });
+
+    it('should focus textAreaEl', () => {
+      expect(textAreaEl.focus).toHaveBeenCalled();
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/helpers/dom_helper_spec.js b/spec/javascripts/image_diff/helpers/dom_helper_spec.js
new file mode 100644
index 00000000000..8dde924e8ae
--- /dev/null
+++ b/spec/javascripts/image_diff/helpers/dom_helper_spec.js
@@ -0,0 +1,118 @@
+import * as domHelper from '~/image_diff/helpers/dom_helper';
+import * as mockData from '../mock_data';
+
+describe('domHelper', () => {
+  const { imageMeta, badgeNumber } = mockData;
+
+  describe('setPositionDataAttribute', () => {
+    let containerEl;
+    let attributeAfterCall;
+    const position = {
+      myProperty: 'myProperty',
+    };
+
+    beforeEach(() => {
+      containerEl = document.createElement('div');
+      containerEl.dataset.position = JSON.stringify(position);
+      domHelper.setPositionDataAttribute(containerEl, imageMeta);
+      attributeAfterCall = JSON.parse(containerEl.dataset.position);
+    });
+
+    it('should set x, y, width, height', () => {
+      expect(attributeAfterCall.x).toEqual(imageMeta.x);
+      expect(attributeAfterCall.y).toEqual(imageMeta.y);
+      expect(attributeAfterCall.width).toEqual(imageMeta.width);
+      expect(attributeAfterCall.height).toEqual(imageMeta.height);
+    });
+
+    it('should not override other properties', () => {
+      expect(attributeAfterCall.myProperty).toEqual('myProperty');
+    });
+  });
+
+  describe('updateDiscussionAvatarBadgeNumber', () => {
+    let discussionEl;
+
+    beforeEach(() => {
+      discussionEl = document.createElement('div');
+      discussionEl.innerHTML = `
+        <a href="#" class="image-diff-avatar-link">
+          <div class="badge"></div>
+        </a>
+      `;
+      domHelper.updateDiscussionAvatarBadgeNumber(discussionEl, badgeNumber);
+    });
+
+    it('should update avatar badge number', () => {
+      expect(discussionEl.querySelector('.badge').innerText).toEqual(badgeNumber.toString());
+    });
+  });
+
+  describe('updateDiscussionBadgeNumber', () => {
+    let discussionEl;
+
+    beforeEach(() => {
+      discussionEl = document.createElement('div');
+      discussionEl.innerHTML = `
+        <div class="badge"></div>
+      `;
+      domHelper.updateDiscussionBadgeNumber(discussionEl, badgeNumber);
+    });
+
+    it('should update discussion badge number', () => {
+      expect(discussionEl.querySelector('.badge').innerText).toEqual(badgeNumber.toString());
+    });
+  });
+
+  describe('toggleCollapsed', () => {
+    let element;
+    let discussionNotesEl;
+
+    beforeEach(() => {
+      element = document.createElement('div');
+      element.innerHTML = `
+        <div class="discussion-notes">
+          <button></button>
+          <form class="discussion-form"></form>
+        </div>
+      `;
+      discussionNotesEl = element.querySelector('.discussion-notes');
+    });
+
+    describe('not collapsed', () => {
+      beforeEach(() => {
+        domHelper.toggleCollapsed({
+          currentTarget: element.querySelector('button'),
+        });
+      });
+
+      it('should add collapsed class', () => {
+        expect(discussionNotesEl.classList.contains('collapsed')).toEqual(true);
+      });
+
+      it('should force formEl to display none', () => {
+        const formEl = element.querySelector('.discussion-form');
+        expect(formEl.style.display).toEqual('none');
+      });
+    });
+
+    describe('collapsed', () => {
+      beforeEach(() => {
+        discussionNotesEl.classList.add('collapsed');
+
+        domHelper.toggleCollapsed({
+          currentTarget: element.querySelector('button'),
+        });
+      });
+
+      it('should remove collapsed class', () => {
+        expect(discussionNotesEl.classList.contains('collapsed')).toEqual(false);
+      });
+
+      it('should force formEl to display block', () => {
+        const formEl = element.querySelector('.discussion-form');
+        expect(formEl.style.display).toEqual('block');
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/helpers/utils_helper_spec.js b/spec/javascripts/image_diff/helpers/utils_helper_spec.js
new file mode 100644
index 00000000000..56d77a05c4c
--- /dev/null
+++ b/spec/javascripts/image_diff/helpers/utils_helper_spec.js
@@ -0,0 +1,207 @@
+import * as utilsHelper from '~/image_diff/helpers/utils_helper';
+import ImageDiff from '~/image_diff/image_diff';
+import ReplacedImageDiff from '~/image_diff/replaced_image_diff';
+import ImageBadge from '~/image_diff/image_badge';
+import * as mockData from '../mock_data';
+
+describe('utilsHelper', () => {
+  const {
+    noteId,
+    discussionId,
+    image,
+    imageProperties,
+    imageMeta,
+  } = mockData;
+
+  describe('resizeCoordinatesToImageElement', () => {
+    let result;
+
+    beforeEach(() => {
+      result = utilsHelper.resizeCoordinatesToImageElement(image, imageMeta);
+    });
+
+    it('should return x based on widthRatio', () => {
+      expect(result.x).toEqual(imageMeta.x * 0.5);
+    });
+
+    it('should return y based on heightRatio', () => {
+      expect(result.y).toEqual(imageMeta.y * 0.5);
+    });
+
+    it('should return image width', () => {
+      expect(result.width).toEqual(image.width);
+    });
+
+    it('should return image height', () => {
+      expect(result.height).toEqual(image.height);
+    });
+  });
+
+  describe('generateBadgeFromDiscussionDOM', () => {
+    let discussionEl;
+    let result;
+
+    beforeEach(() => {
+      const imageFrameEl = document.createElement('div');
+      imageFrameEl.innerHTML = `
+        <img src="${gl.TEST_HOST}/image.png">
+      `;
+      discussionEl = document.createElement('div');
+      discussionEl.dataset.discussionId = discussionId;
+      discussionEl.innerHTML = `
+        <div class="note" id="${noteId}"></div>
+      `;
+      discussionEl.dataset.position = JSON.stringify(imageMeta);
+      result = utilsHelper.generateBadgeFromDiscussionDOM(imageFrameEl, discussionEl);
+    });
+
+    it('should return actual image properties', () => {
+      const { actual } = result;
+      expect(actual.x).toEqual(imageMeta.x);
+      expect(actual.y).toEqual(imageMeta.y);
+      expect(actual.width).toEqual(imageMeta.width);
+      expect(actual.height).toEqual(imageMeta.height);
+    });
+
+    it('should return browser image properties', () => {
+      const { browser } = result;
+      expect(browser.x).toBeDefined();
+      expect(browser.y).toBeDefined();
+      expect(browser.width).toBeDefined();
+      expect(browser.height).toBeDefined();
+    });
+
+    it('should return instance of ImageBadge', () => {
+      expect(result instanceof ImageBadge).toEqual(true);
+    });
+
+    it('should return noteId', () => {
+      expect(result.noteId).toEqual(noteId);
+    });
+
+    it('should return discussionId', () => {
+      expect(result.discussionId).toEqual(discussionId);
+    });
+  });
+
+  describe('getTargetSelection', () => {
+    let containerEl;
+
+    beforeEach(() => {
+      containerEl = {
+        querySelector: () => imageProperties,
+      };
+    });
+
+    function generateEvent(offsetX, offsetY) {
+      return {
+        currentTarget: containerEl,
+        offsetX,
+        offsetY,
+      };
+    }
+
+    it('should return browser properties', () => {
+      const event = generateEvent(25, 25);
+      const result = utilsHelper.getTargetSelection(event);
+
+      const { browser } = result;
+      expect(browser.x).toEqual(event.offsetX);
+      expect(browser.y).toEqual(event.offsetY);
+      expect(browser.width).toEqual(imageProperties.width);
+      expect(browser.height).toEqual(imageProperties.height);
+    });
+
+    it('should return resized actual image properties', () => {
+      const event = generateEvent(50, 50);
+      const result = utilsHelper.getTargetSelection(event);
+
+      const { actual } = result;
+      expect(actual.x).toEqual(100);
+      expect(actual.y).toEqual(100);
+      expect(actual.width).toEqual(imageProperties.naturalWidth);
+      expect(actual.height).toEqual(imageProperties.naturalHeight);
+    });
+
+    describe('normalize coordinates', () => {
+      it('should return x = 0 if x < 0', () => {
+        const event = generateEvent(-5, 50);
+        const result = utilsHelper.getTargetSelection(event);
+        expect(result.browser.x).toEqual(0);
+      });
+
+      it('should return x = width if x > width', () => {
+        const event = generateEvent(1000, 50);
+        const result = utilsHelper.getTargetSelection(event);
+        expect(result.browser.x).toEqual(imageProperties.width);
+      });
+
+      it('should return y = 0 if y < 0', () => {
+        const event = generateEvent(50, -10);
+        const result = utilsHelper.getTargetSelection(event);
+        expect(result.browser.y).toEqual(0);
+      });
+
+      it('should return y = height if y > height', () => {
+        const event = generateEvent(50, 1000);
+        const result = utilsHelper.getTargetSelection(event);
+        expect(result.browser.y).toEqual(imageProperties.height);
+      });
+    });
+  });
+
+  describe('initImageDiff', () => {
+    let glCache;
+    let fileEl;
+
+    beforeEach(() => {
+      window.gl = window.gl || (window.gl = {});
+      glCache = window.gl;
+      window.gl.ImageFile = () => {};
+      fileEl = document.createElement('div');
+      fileEl.innerHTML = `
+        <div class="diff-file"></div>
+      `;
+
+      spyOn(ImageDiff.prototype, 'init').and.callFake(() => {});
+      spyOn(ReplacedImageDiff.prototype, 'init').and.callFake(() => {});
+    });
+
+    afterEach(() => {
+      window.gl = glCache;
+    });
+
+    it('should initialize gl.ImageFile', () => {
+      spyOn(window.gl, 'ImageFile');
+
+      utilsHelper.initImageDiff(fileEl, false, false);
+      expect(gl.ImageFile).toHaveBeenCalled();
+    });
+
+    it('should initialize ImageDiff if js-single-image', () => {
+      const diffFileEl = fileEl.querySelector('.diff-file');
+      diffFileEl.innerHTML = `
+        <div class="js-single-image">
+        </div>
+      `;
+
+      const imageDiff = utilsHelper.initImageDiff(fileEl, true, false);
+      expect(ImageDiff.prototype.init).toHaveBeenCalled();
+      expect(imageDiff.canCreateNote).toEqual(true);
+      expect(imageDiff.renderCommentBadge).toEqual(false);
+    });
+
+    it('should initialize ReplacedImageDiff if js-replaced-image', () => {
+      const diffFileEl = fileEl.querySelector('.diff-file');
+      diffFileEl.innerHTML = `
+        <div class="js-replaced-image">
+        </div>
+      `;
+
+      const replacedImageDiff = utilsHelper.initImageDiff(fileEl, false, true);
+      expect(ReplacedImageDiff.prototype.init).toHaveBeenCalled();
+      expect(replacedImageDiff.canCreateNote).toEqual(false);
+      expect(replacedImageDiff.renderCommentBadge).toEqual(true);
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/image_badge_spec.js b/spec/javascripts/image_diff/image_badge_spec.js
new file mode 100644
index 00000000000..87f98fc0926
--- /dev/null
+++ b/spec/javascripts/image_diff/image_badge_spec.js
@@ -0,0 +1,84 @@
+import ImageBadge from '~/image_diff/image_badge';
+import imageDiffHelper from '~/image_diff/helpers/index';
+import * as mockData from './mock_data';
+
+describe('ImageBadge', () => {
+  const { noteId, discussionId, imageMeta } = mockData;
+  const options = {
+    noteId,
+    discussionId,
+  };
+
+  it('should save actual property', () => {
+    const imageBadge = new ImageBadge(Object.assign({}, options, {
+      actual: imageMeta,
+    }));
+
+    const { actual } = imageBadge;
+    expect(actual.x).toEqual(imageMeta.x);
+    expect(actual.y).toEqual(imageMeta.y);
+    expect(actual.width).toEqual(imageMeta.width);
+    expect(actual.height).toEqual(imageMeta.height);
+  });
+
+  it('should save browser property', () => {
+    const imageBadge = new ImageBadge(Object.assign({}, options, {
+      browser: imageMeta,
+    }));
+
+    const { browser } = imageBadge;
+    expect(browser.x).toEqual(imageMeta.x);
+    expect(browser.y).toEqual(imageMeta.y);
+    expect(browser.width).toEqual(imageMeta.width);
+    expect(browser.height).toEqual(imageMeta.height);
+  });
+
+  it('should save noteId', () => {
+    const imageBadge = new ImageBadge(options);
+    expect(imageBadge.noteId).toEqual(noteId);
+  });
+
+  it('should save discussionId', () => {
+    const imageBadge = new ImageBadge(options);
+    expect(imageBadge.discussionId).toEqual(discussionId);
+  });
+
+  describe('default values', () => {
+    let imageBadge;
+
+    beforeEach(() => {
+      imageBadge = new ImageBadge(options);
+    });
+
+    it('should return defaultimageMeta if actual property is not provided', () => {
+      const { actual } = imageBadge;
+      expect(actual.x).toEqual(0);
+      expect(actual.y).toEqual(0);
+      expect(actual.width).toEqual(0);
+      expect(actual.height).toEqual(0);
+    });
+
+    it('should return defaultimageMeta if browser property is not provided', () => {
+      const { browser } = imageBadge;
+      expect(browser.x).toEqual(0);
+      expect(browser.y).toEqual(0);
+      expect(browser.width).toEqual(0);
+      expect(browser.height).toEqual(0);
+    });
+  });
+
+  describe('imageEl property is provided and not browser property', () => {
+    beforeEach(() => {
+      spyOn(imageDiffHelper, 'resizeCoordinatesToImageElement').and.returnValue(true);
+    });
+
+    it('should generate browser property', () => {
+      const imageBadge = new ImageBadge(Object.assign({}, options, {
+        imageEl: document.createElement('img'),
+      }));
+
+      expect(imageDiffHelper.resizeCoordinatesToImageElement).toHaveBeenCalled();
+      expect(imageBadge.browser).toEqual(true);
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/image_diff_spec.js b/spec/javascripts/image_diff/image_diff_spec.js
new file mode 100644
index 00000000000..346282328c7
--- /dev/null
+++ b/spec/javascripts/image_diff/image_diff_spec.js
@@ -0,0 +1,361 @@
+import ImageDiff from '~/image_diff/image_diff';
+import * as imageUtility from '~/lib/utils/image_utility';
+import imageDiffHelper from '~/image_diff/helpers/index';
+import * as mockData from './mock_data';
+
+describe('ImageDiff', () => {
+  let element;
+  let imageDiff;
+
+  beforeEach(() => {
+    setFixtures(`
+      <div id="element">
+        <div class="diff-file">
+          <div class="js-image-frame">
+            <img src="${gl.TEST_HOST}/image.png">
+            <div class="comment-indicator"></div>
+            <div id="badge-1" class="badge">1</div>
+            <div id="badge-2" class="badge">2</div>
+            <div id="badge-3" class="badge">3</div>
+          </div>
+          <div class="note-container">
+            <div class="discussion-notes">
+              <div class="js-diff-notes-toggle"></div>
+              <div class="notes"></div>
+            </div>
+            <div class="discussion-notes">
+              <div class="js-diff-notes-toggle"></div>
+              <div class="notes"></div>
+            </div>
+          </div>
+        </div>
+      </div>
+    `);
+    element = document.getElementById('element');
+  });
+
+  describe('constructor', () => {
+    beforeEach(() => {
+      imageDiff = new ImageDiff(element, {
+        canCreateNote: true,
+        renderCommentBadge: true,
+      });
+    });
+
+    it('should set el', () => {
+      expect(imageDiff.el).toEqual(element);
+    });
+
+    it('should set canCreateNote', () => {
+      expect(imageDiff.canCreateNote).toEqual(true);
+    });
+
+    it('should set renderCommentBadge', () => {
+      expect(imageDiff.renderCommentBadge).toEqual(true);
+    });
+
+    it('should set $noteContainer', () => {
+      expect(imageDiff.$noteContainer[0]).toEqual(element.querySelector('.note-container'));
+    });
+
+    describe('default', () => {
+      beforeEach(() => {
+        imageDiff = new ImageDiff(element);
+      });
+
+      it('should set canCreateNote as false', () => {
+        expect(imageDiff.canCreateNote).toEqual(false);
+      });
+
+      it('should set renderCommentBadge as false', () => {
+        expect(imageDiff.renderCommentBadge).toEqual(false);
+      });
+    });
+  });
+
+  describe('init', () => {
+    beforeEach(() => {
+      spyOn(ImageDiff.prototype, 'bindEvents').and.callFake(() => {});
+      imageDiff = new ImageDiff(element);
+      imageDiff.init();
+    });
+
+    it('should set imageFrameEl', () => {
+      expect(imageDiff.imageFrameEl).toEqual(element.querySelector('.diff-file .js-image-frame'));
+    });
+
+    it('should set imageEl', () => {
+      expect(imageDiff.imageEl).toEqual(element.querySelector('.diff-file .js-image-frame img'));
+    });
+
+    it('should call bindEvents', () => {
+      expect(imageDiff.bindEvents).toHaveBeenCalled();
+    });
+  });
+
+  describe('bindEvents', () => {
+    let imageEl;
+
+    beforeEach(() => {
+      spyOn(imageDiffHelper, 'toggleCollapsed').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'commentIndicatorOnClick').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'removeCommentIndicator').and.callFake(() => {});
+      spyOn(ImageDiff.prototype, 'imageClicked').and.callFake(() => {});
+      spyOn(ImageDiff.prototype, 'addBadge').and.callFake(() => {});
+      spyOn(ImageDiff.prototype, 'removeBadge').and.callFake(() => {});
+      spyOn(ImageDiff.prototype, 'renderBadges').and.callFake(() => {});
+      imageEl = element.querySelector('.diff-file .js-image-frame img');
+    });
+
+    describe('default', () => {
+      beforeEach(() => {
+        spyOn(imageUtility, 'isImageLoaded').and.returnValue(false);
+        imageDiff = new ImageDiff(element);
+        imageDiff.imageEl = imageEl;
+        imageDiff.bindEvents();
+      });
+
+      it('should register click event delegation to js-diff-notes-toggle', () => {
+        element.querySelector('.js-diff-notes-toggle').click();
+        expect(imageDiffHelper.toggleCollapsed).toHaveBeenCalled();
+      });
+
+      it('should register click event delegation to comment-indicator', () => {
+        element.querySelector('.comment-indicator').click();
+        expect(imageDiffHelper.commentIndicatorOnClick).toHaveBeenCalled();
+      });
+    });
+
+    describe('image loaded', () => {
+      beforeEach(() => {
+        spyOn(imageUtility, 'isImageLoaded').and.returnValue(true);
+        imageDiff = new ImageDiff(element);
+        imageDiff.imageEl = imageEl;
+      });
+
+      it('should renderBadges', () => {});
+    });
+
+    describe('image not loaded', () => {
+      beforeEach(() => {
+        spyOn(imageUtility, 'isImageLoaded').and.returnValue(false);
+        imageDiff = new ImageDiff(element);
+        imageDiff.imageEl = imageEl;
+        imageDiff.bindEvents();
+      });
+
+      it('should registers load eventListener', () => {
+        const loadEvent = new Event('load');
+        imageEl.dispatchEvent(loadEvent);
+        expect(imageDiff.renderBadges).toHaveBeenCalled();
+      });
+    });
+
+    describe('canCreateNote', () => {
+      beforeEach(() => {
+        spyOn(imageUtility, 'isImageLoaded').and.returnValue(false);
+        imageDiff = new ImageDiff(element, {
+          canCreateNote: true,
+        });
+        imageDiff.imageEl = imageEl;
+        imageDiff.bindEvents();
+      });
+
+      it('should register click.imageDiff event', () => {
+        const event = new CustomEvent('click.imageDiff');
+        element.dispatchEvent(event);
+        expect(imageDiff.imageClicked).toHaveBeenCalled();
+      });
+
+      it('should register blur.imageDiff event', () => {
+        const event = new CustomEvent('blur.imageDiff');
+        element.dispatchEvent(event);
+        expect(imageDiffHelper.removeCommentIndicator).toHaveBeenCalled();
+      });
+
+      it('should register addBadge.imageDiff event', () => {
+        const event = new CustomEvent('addBadge.imageDiff');
+        element.dispatchEvent(event);
+        expect(imageDiff.addBadge).toHaveBeenCalled();
+      });
+
+      it('should register removeBadge.imageDiff event', () => {
+        const event = new CustomEvent('removeBadge.imageDiff');
+        element.dispatchEvent(event);
+        expect(imageDiff.removeBadge).toHaveBeenCalled();
+      });
+    });
+
+    describe('canCreateNote is false', () => {
+      beforeEach(() => {
+        spyOn(imageUtility, 'isImageLoaded').and.returnValue(false);
+        imageDiff = new ImageDiff(element);
+        imageDiff.imageEl = imageEl;
+        imageDiff.bindEvents();
+      });
+
+      it('should not register click.imageDiff event', () => {
+        const event = new CustomEvent('click.imageDiff');
+        element.dispatchEvent(event);
+        expect(imageDiff.imageClicked).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('imageClicked', () => {
+    beforeEach(() => {
+      spyOn(imageDiffHelper, 'getTargetSelection').and.returnValue({
+        actual: {},
+        browser: {},
+      });
+      spyOn(imageDiffHelper, 'setPositionDataAttribute').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'showCommentIndicator').and.callFake(() => {});
+      imageDiff = new ImageDiff(element);
+      imageDiff.imageClicked({
+        detail: {
+          currentTarget: {},
+        },
+      });
+    });
+
+    it('should call getTargetSelection', () => {
+      expect(imageDiffHelper.getTargetSelection).toHaveBeenCalled();
+    });
+
+    it('should call setPositionDataAttribute', () => {
+      expect(imageDiffHelper.setPositionDataAttribute).toHaveBeenCalled();
+    });
+
+    it('should call showCommentIndicator', () => {
+      expect(imageDiffHelper.showCommentIndicator).toHaveBeenCalled();
+    });
+  });
+
+  describe('renderBadges', () => {
+    beforeEach(() => {
+      spyOn(ImageDiff.prototype, 'renderBadge').and.callFake(() => {});
+      imageDiff = new ImageDiff(element);
+      imageDiff.renderBadges();
+    });
+
+    it('should call renderBadge for each discussionEl', () => {
+      const discussionEls = element.querySelectorAll('.note-container .discussion-notes .notes');
+      expect(imageDiff.renderBadge.calls.count()).toEqual(discussionEls.length);
+    });
+  });
+
+  describe('renderBadge', () => {
+    let discussionEls;
+
+    beforeEach(() => {
+      spyOn(imageDiffHelper, 'addImageBadge').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'addImageCommentBadge').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'generateBadgeFromDiscussionDOM').and.returnValue({
+        browser: {},
+        noteId: 'noteId',
+      });
+      discussionEls = element.querySelectorAll('.note-container .discussion-notes .notes');
+      imageDiff = new ImageDiff(element);
+      imageDiff.renderBadge(discussionEls[0], 0);
+    });
+
+    it('should populate imageBadges', () => {
+      expect(imageDiff.imageBadges.length).toEqual(1);
+    });
+
+    describe('renderCommentBadge', () => {
+      beforeEach(() => {
+        imageDiff.renderCommentBadge = true;
+        imageDiff.renderBadge(discussionEls[0], 0);
+      });
+
+      it('should call addImageCommentBadge', () => {
+        expect(imageDiffHelper.addImageCommentBadge).toHaveBeenCalled();
+      });
+    });
+
+    describe('renderCommentBadge is false', () => {
+      it('should call addImageBadge', () => {
+        expect(imageDiffHelper.addImageBadge).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('addBadge', () => {
+    beforeEach(() => {
+      spyOn(imageDiffHelper, 'addImageBadge').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'addAvatarBadge').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'updateDiscussionBadgeNumber').and.callFake(() => {});
+      imageDiff = new ImageDiff(element);
+      imageDiff.imageFrameEl = element.querySelector('.diff-file .js-image-frame');
+      imageDiff.addBadge({
+        detail: {
+          x: 0,
+          y: 1,
+          width: 25,
+          height: 50,
+          noteId: 'noteId',
+          discussionId: 'discussionId',
+        },
+      });
+    });
+
+    it('should add imageBadge to imageBadges', () => {
+      expect(imageDiff.imageBadges.length).toEqual(1);
+    });
+
+    it('should call addImageBadge', () => {
+      expect(imageDiffHelper.addImageBadge).toHaveBeenCalled();
+    });
+
+    it('should call addAvatarBadge', () => {
+      expect(imageDiffHelper.addAvatarBadge).toHaveBeenCalled();
+    });
+
+    it('should call updateDiscussionBadgeNumber', () => {
+      expect(imageDiffHelper.updateDiscussionBadgeNumber).toHaveBeenCalled();
+    });
+  });
+
+  describe('removeBadge', () => {
+    beforeEach(() => {
+      const { imageMeta } = mockData;
+
+      spyOn(imageDiffHelper, 'updateDiscussionBadgeNumber').and.callFake(() => {});
+      spyOn(imageDiffHelper, 'updateDiscussionAvatarBadgeNumber').and.callFake(() => {});
+      imageDiff = new ImageDiff(element);
+      imageDiff.imageBadges = [imageMeta, imageMeta, imageMeta];
+      imageDiff.imageFrameEl = element.querySelector('.diff-file .js-image-frame');
+      imageDiff.removeBadge({
+        detail: {
+          badgeNumber: 2,
+        },
+      });
+    });
+
+    describe('cascade badge count', () => {
+      it('should update next imageBadgeEl value', () => {
+        const imageBadgeEls = imageDiff.imageFrameEl.querySelectorAll('.badge');
+        expect(imageBadgeEls[0].innerText).toEqual('1');
+        expect(imageBadgeEls[1].innerText).toEqual('2');
+        expect(imageBadgeEls.length).toEqual(2);
+      });
+
+      it('should call updateDiscussionBadgeNumber', () => {
+        expect(imageDiffHelper.updateDiscussionBadgeNumber).toHaveBeenCalled();
+      });
+
+      it('should call updateDiscussionAvatarBadgeNumber', () => {
+        expect(imageDiffHelper.updateDiscussionAvatarBadgeNumber).toHaveBeenCalled();
+      });
+    });
+
+    it('should remove badge from imageBadges', () => {
+      expect(imageDiff.imageBadges.length).toEqual(2);
+    });
+
+    it('should remove imageBadgeEl', () => {
+      expect(imageDiff.imageFrameEl.querySelector('#badge-2')).toBeNull();
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/init_discussion_tab_spec.js b/spec/javascripts/image_diff/init_discussion_tab_spec.js
new file mode 100644
index 00000000000..7c447d6f70d
--- /dev/null
+++ b/spec/javascripts/image_diff/init_discussion_tab_spec.js
@@ -0,0 +1,37 @@
+import initDiscussionTab from '~/image_diff/init_discussion_tab';
+import imageDiffHelper from '~/image_diff/helpers/index';
+
+describe('initDiscussionTab', () => {
+  beforeEach(() => {
+    setFixtures(`
+      <div class="timeline-content">
+        <div class="diff-file js-image-file"></div>
+        <div class="diff-file js-image-file"></div>
+      </div>
+    `);
+  });
+
+  it('should pass canCreateNote as false to initImageDiff', (done) => {
+    spyOn(imageDiffHelper, 'initImageDiff').and.callFake((diffFileEl, canCreateNote) => {
+      expect(canCreateNote).toEqual(false);
+      done();
+    });
+
+    initDiscussionTab();
+  });
+
+  it('should pass renderCommentBadge as true to initImageDiff', (done) => {
+    spyOn(imageDiffHelper, 'initImageDiff').and.callFake((diffFileEl, canCreateNote, renderCommentBadge) => {
+      expect(renderCommentBadge).toEqual(true);
+      done();
+    });
+
+    initDiscussionTab();
+  });
+
+  it('should call initImageDiff for each diffFileEls', () => {
+    spyOn(imageDiffHelper, 'initImageDiff').and.callFake(() => {});
+    initDiscussionTab();
+    expect(imageDiffHelper.initImageDiff.calls.count()).toEqual(2);
+  });
+});
diff --git a/spec/javascripts/image_diff/mock_data.js b/spec/javascripts/image_diff/mock_data.js
new file mode 100644
index 00000000000..a0d1732dd0a
--- /dev/null
+++ b/spec/javascripts/image_diff/mock_data.js
@@ -0,0 +1,28 @@
+export const noteId = 'noteId';
+export const discussionId = 'discussionId';
+export const badgeText = 'badgeText';
+export const badgeNumber = 5;
+
+export const coordinate = {
+  x: 100,
+  y: 100,
+};
+
+export const image = {
+  width: 100,
+  height: 100,
+};
+
+export const imageProperties = {
+  width: image.width,
+  height: image.height,
+  naturalWidth: image.width * 2,
+  naturalHeight: image.height * 2,
+};
+
+export const imageMeta = {
+  x: coordinate.x,
+  y: coordinate.y,
+  width: imageProperties.naturalWidth,
+  height: imageProperties.naturalHeight,
+};
diff --git a/spec/javascripts/image_diff/replaced_image_diff_spec.js b/spec/javascripts/image_diff/replaced_image_diff_spec.js
new file mode 100644
index 00000000000..5f8cd7c531a
--- /dev/null
+++ b/spec/javascripts/image_diff/replaced_image_diff_spec.js
@@ -0,0 +1,312 @@
+import ReplacedImageDiff from '~/image_diff/replaced_image_diff';
+import ImageDiff from '~/image_diff/image_diff';
+import { viewTypes } from '~/image_diff/view_types';
+import imageDiffHelper from '~/image_diff/helpers/index';
+
+describe('ReplacedImageDiff', () => {
+  let element;
+  let replacedImageDiff;
+
+  beforeEach(() => {
+    setFixtures(`
+      <div id="element">
+        <div class="two-up">
+          <div class="js-image-frame">
+            <img src="${gl.TEST_HOST}/image.png">
+          </div>
+        </div>
+        <div class="swipe">
+          <div class="js-image-frame">
+            <img src="${gl.TEST_HOST}/image.png">
+          </div>
+        </div>
+        <div class="onion-skin">
+          <div class="js-image-frame">
+            <img src="${gl.TEST_HOST}/image.png">
+          </div>
+        </div>
+        <div class="view-modes-menu">
+          <div class="two-up">2-up</div>
+          <div class="swipe">Swipe</div>
+          <div class="onion-skin">Onion skin</div>
+        </div>
+      </div>
+    `);
+    element = document.getElementById('element');
+  });
+
+  function setupImageFrameEls() {
+    replacedImageDiff.imageFrameEls = [];
+    replacedImageDiff.imageFrameEls[viewTypes.TWO_UP] = element.querySelector('.two-up .js-image-frame');
+    replacedImageDiff.imageFrameEls[viewTypes.SWIPE] = element.querySelector('.swipe .js-image-frame');
+    replacedImageDiff.imageFrameEls[viewTypes.ONION_SKIN] = element.querySelector('.onion-skin .js-image-frame');
+  }
+
+  function setupViewModesEls() {
+    replacedImageDiff.viewModesEls = [];
+    replacedImageDiff.viewModesEls[viewTypes.TWO_UP] = element.querySelector('.view-modes-menu .two-up');
+    replacedImageDiff.viewModesEls[viewTypes.SWIPE] = element.querySelector('.view-modes-menu .swipe');
+    replacedImageDiff.viewModesEls[viewTypes.ONION_SKIN] = element.querySelector('.view-modes-menu .onion-skin');
+  }
+
+  function setupImageEls() {
+    replacedImageDiff.imageEls = [];
+    replacedImageDiff.imageEls[viewTypes.TWO_UP] = element.querySelector('.two-up img');
+    replacedImageDiff.imageEls[viewTypes.SWIPE] = element.querySelector('.swipe img');
+    replacedImageDiff.imageEls[viewTypes.ONION_SKIN] = element.querySelector('.onion-skin img');
+  }
+
+  it('should extend ImageDiff', () => {
+    replacedImageDiff = new ReplacedImageDiff(element);
+    expect(replacedImageDiff instanceof ImageDiff).toEqual(true);
+  });
+
+  describe('init', () => {
+    beforeEach(() => {
+      spyOn(ReplacedImageDiff.prototype, 'bindEvents').and.callFake(() => {});
+      spyOn(ReplacedImageDiff.prototype, 'generateImageEls').and.callFake(() => {});
+
+      replacedImageDiff = new ReplacedImageDiff(element);
+      replacedImageDiff.init();
+    });
+
+    it('should set imageFrameEls', () => {
+      const { imageFrameEls } = replacedImageDiff;
+      expect(imageFrameEls).toBeDefined();
+      expect(imageFrameEls[viewTypes.TWO_UP]).toEqual(element.querySelector('.two-up .js-image-frame'));
+      expect(imageFrameEls[viewTypes.SWIPE]).toEqual(element.querySelector('.swipe .js-image-frame'));
+      expect(imageFrameEls[viewTypes.ONION_SKIN]).toEqual(element.querySelector('.onion-skin .js-image-frame'));
+    });
+
+    it('should set viewModesEls', () => {
+      const { viewModesEls } = replacedImageDiff;
+      expect(viewModesEls).toBeDefined();
+      expect(viewModesEls[viewTypes.TWO_UP]).toEqual(element.querySelector('.view-modes-menu .two-up'));
+      expect(viewModesEls[viewTypes.SWIPE]).toEqual(element.querySelector('.view-modes-menu .swipe'));
+      expect(viewModesEls[viewTypes.ONION_SKIN]).toEqual(element.querySelector('.view-modes-menu .onion-skin'));
+    });
+
+    it('should generateImageEls', () => {
+      expect(ReplacedImageDiff.prototype.generateImageEls).toHaveBeenCalled();
+    });
+
+    it('should bindEvents', () => {
+      expect(ReplacedImageDiff.prototype.bindEvents).toHaveBeenCalled();
+    });
+
+    describe('currentView', () => {
+      it('should set currentView', () => {
+        replacedImageDiff.init(viewTypes.ONION_SKIN);
+        expect(replacedImageDiff.currentView).toEqual(viewTypes.ONION_SKIN);
+      });
+
+      it('should default to viewTypes.TWO_UP', () => {
+        expect(replacedImageDiff.currentView).toEqual(viewTypes.TWO_UP);
+      });
+    });
+  });
+
+  describe('generateImageEls', () => {
+    beforeEach(() => {
+      spyOn(ReplacedImageDiff.prototype, 'bindEvents').and.callFake(() => {});
+
+      replacedImageDiff = new ReplacedImageDiff(element, {
+        canCreateNote: false,
+        renderCommentBadge: false,
+      });
+
+      setupImageFrameEls();
+    });
+
+    it('should set imageEls', () => {
+      replacedImageDiff.generateImageEls();
+      const { imageEls } = replacedImageDiff;
+      expect(imageEls).toBeDefined();
+      expect(imageEls[viewTypes.TWO_UP]).toEqual(element.querySelector('.two-up img'));
+      expect(imageEls[viewTypes.SWIPE]).toEqual(element.querySelector('.swipe img'));
+      expect(imageEls[viewTypes.ONION_SKIN]).toEqual(element.querySelector('.onion-skin img'));
+    });
+  });
+
+  describe('bindEvents', () => {
+    beforeEach(() => {
+      spyOn(ImageDiff.prototype, 'bindEvents').and.callFake(() => {});
+      replacedImageDiff = new ReplacedImageDiff(element);
+
+      setupViewModesEls();
+    });
+
+    it('should call super.bindEvents', () => {
+      replacedImageDiff.bindEvents();
+      expect(ImageDiff.prototype.bindEvents).toHaveBeenCalled();
+    });
+
+    it('should register click eventlistener to 2-up view mode', (done) => {
+      spyOn(ReplacedImageDiff.prototype, 'changeView').and.callFake((viewMode) => {
+        expect(viewMode).toEqual(viewTypes.TWO_UP);
+        done();
+      });
+
+      replacedImageDiff.bindEvents();
+      replacedImageDiff.viewModesEls[viewTypes.TWO_UP].click();
+    });
+
+    it('should register click eventlistener to swipe view mode', (done) => {
+      spyOn(ReplacedImageDiff.prototype, 'changeView').and.callFake((viewMode) => {
+        expect(viewMode).toEqual(viewTypes.SWIPE);
+        done();
+      });
+
+      replacedImageDiff.bindEvents();
+      replacedImageDiff.viewModesEls[viewTypes.SWIPE].click();
+    });
+
+    it('should register click eventlistener to onion skin view mode', (done) => {
+      spyOn(ReplacedImageDiff.prototype, 'changeView').and.callFake((viewMode) => {
+        expect(viewMode).toEqual(viewTypes.SWIPE);
+        done();
+      });
+
+      replacedImageDiff.bindEvents();
+      replacedImageDiff.viewModesEls[viewTypes.SWIPE].click();
+    });
+  });
+
+  describe('getters', () => {
+    describe('imageEl', () => {
+      beforeEach(() => {
+        replacedImageDiff = new ReplacedImageDiff(element);
+        replacedImageDiff.currentView = viewTypes.TWO_UP;
+        setupImageEls();
+      });
+
+      it('should return imageEl based on currentView', () => {
+        expect(replacedImageDiff.imageEl).toEqual(element.querySelector('.two-up img'));
+
+        replacedImageDiff.currentView = viewTypes.SWIPE;
+        expect(replacedImageDiff.imageEl).toEqual(element.querySelector('.swipe img'));
+      });
+    });
+
+    describe('imageFrameEl', () => {
+      beforeEach(() => {
+        replacedImageDiff = new ReplacedImageDiff(element);
+        replacedImageDiff.currentView = viewTypes.TWO_UP;
+        setupImageFrameEls();
+      });
+
+      it('should return imageFrameEl based on currentView', () => {
+        expect(replacedImageDiff.imageFrameEl).toEqual(element.querySelector('.two-up .js-image-frame'));
+
+        replacedImageDiff.currentView = viewTypes.ONION_SKIN;
+        expect(replacedImageDiff.imageFrameEl).toEqual(element.querySelector('.onion-skin .js-image-frame'));
+      });
+    });
+  });
+
+  describe('changeView', () => {
+    beforeEach(() => {
+      replacedImageDiff = new ReplacedImageDiff(element);
+      spyOn(imageDiffHelper, 'removeCommentIndicator').and.returnValue({
+        removed: false,
+      });
+      setupImageFrameEls();
+    });
+
+    describe('invalid viewType', () => {
+      beforeEach(() => {
+        replacedImageDiff.changeView('some-view-name');
+      });
+
+      it('should not call removeCommentIndicator', () => {
+        expect(imageDiffHelper.removeCommentIndicator).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('valid viewType', () => {
+      beforeEach(() => {
+        jasmine.clock().install();
+        spyOn(ReplacedImageDiff.prototype, 'renderNewView').and.callFake(() => {});
+        replacedImageDiff.changeView(viewTypes.ONION_SKIN);
+      });
+
+      afterEach(() => {
+        jasmine.clock().uninstall();
+      });
+
+      it('should call removeCommentIndicator', () => {
+        expect(imageDiffHelper.removeCommentIndicator).toHaveBeenCalled();
+      });
+
+      it('should update currentView to newView', () => {
+        expect(replacedImageDiff.currentView).toEqual(viewTypes.ONION_SKIN);
+      });
+
+      it('should clear imageBadges', () => {
+        expect(replacedImageDiff.imageBadges.length).toEqual(0);
+      });
+
+      it('should call renderNewView', () => {
+        jasmine.clock().tick(251);
+        expect(replacedImageDiff.renderNewView).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('renderNewView', () => {
+    beforeEach(() => {
+      replacedImageDiff = new ReplacedImageDiff(element);
+    });
+
+    it('should call renderBadges', () => {
+      spyOn(ReplacedImageDiff.prototype, 'renderBadges').and.callFake(() => {});
+
+      replacedImageDiff.renderNewView({
+        removed: false,
+      });
+
+      expect(replacedImageDiff.renderBadges).toHaveBeenCalled();
+    });
+
+    describe('removeIndicator', () => {
+      const indicator = {
+        removed: true,
+        x: 0,
+        y: 1,
+        image: {
+          width: 50,
+          height: 100,
+        },
+      };
+
+      beforeEach(() => {
+        setupImageEls();
+        setupImageFrameEls();
+      });
+
+      it('should pass showCommentIndicator normalized indicator values', (done) => {
+        spyOn(imageDiffHelper, 'showCommentIndicator').and.callFake(() => {});
+        spyOn(imageDiffHelper, 'resizeCoordinatesToImageElement').and.callFake((imageEl, meta) => {
+          expect(meta.x).toEqual(indicator.x);
+          expect(meta.y).toEqual(indicator.y);
+          expect(meta.width).toEqual(indicator.image.width);
+          expect(meta.height).toEqual(indicator.image.height);
+          done();
+        });
+        replacedImageDiff.renderNewView(indicator);
+      });
+
+      it('should call showCommentIndicator', (done) => {
+        const normalized = {
+          normalized: true,
+        };
+        spyOn(imageDiffHelper, 'resizeCoordinatesToImageElement').and.returnValue(normalized);
+        spyOn(imageDiffHelper, 'showCommentIndicator').and.callFake((imageFrameEl, normalizedIndicator) => {
+          expect(normalizedIndicator).toEqual(normalized);
+          done();
+        });
+        replacedImageDiff.renderNewView(indicator);
+      });
+    });
+  });
+});
diff --git a/spec/javascripts/image_diff/view_types_spec.js b/spec/javascripts/image_diff/view_types_spec.js
new file mode 100644
index 00000000000..e9639f46497
--- /dev/null
+++ b/spec/javascripts/image_diff/view_types_spec.js
@@ -0,0 +1,24 @@
+import { viewTypes, isValidViewType } from '~/image_diff/view_types';
+
+describe('viewTypes', () => {
+  describe('isValidViewType', () => {
+    it('should return true for TWO_UP', () => {
+      expect(isValidViewType(viewTypes.TWO_UP)).toEqual(true);
+    });
+
+    it('should return true for SWIPE', () => {
+      expect(isValidViewType(viewTypes.SWIPE)).toEqual(true);
+    });
+
+    it('should return true for ONION_SKIN', () => {
+      expect(isValidViewType(viewTypes.ONION_SKIN)).toEqual(true);
+    });
+
+    it('should return false for non view types', () => {
+      expect(isValidViewType('some-view-type')).toEqual(false);
+      expect(isValidViewType(null)).toEqual(false);
+      expect(isValidViewType(undefined)).toEqual(false);
+      expect(isValidViewType('')).toEqual(false);
+    });
+  });
+});
diff --git a/spec/javascripts/lib/utils/image_utility_spec.js b/spec/javascripts/lib/utils/image_utility_spec.js
new file mode 100644
index 00000000000..75addfcc833
--- /dev/null
+++ b/spec/javascripts/lib/utils/image_utility_spec.js
@@ -0,0 +1,32 @@
+import * as imageUtility from '~/lib/utils/image_utility';
+
+describe('imageUtility', () => {
+  describe('isImageLoaded', () => {
+    it('should return false when image.complete is false', () => {
+      const element = {
+        complete: false,
+        naturalHeight: 100,
+      };
+
+      expect(imageUtility.isImageLoaded(element)).toEqual(false);
+    });
+
+    it('should return false when naturalHeight = 0', () => {
+      const element = {
+        complete: true,
+        naturalHeight: 0,
+      };
+
+      expect(imageUtility.isImageLoaded(element)).toEqual(false);
+    });
+
+    it('should return true when image.complete and naturalHeight != 0', () => {
+      const element = {
+        complete: true,
+        naturalHeight: 100,
+      };
+
+      expect(imageUtility.isImageLoaded(element)).toEqual(true);
+    });
+  });
+});
diff --git a/spec/lib/gitlab/diff/formatters/image_formatter_spec.rb b/spec/lib/gitlab/diff/formatters/image_formatter_spec.rb
new file mode 100644
index 00000000000..2f99febe04e
--- /dev/null
+++ b/spec/lib/gitlab/diff/formatters/image_formatter_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe Gitlab::Diff::Formatters::ImageFormatter do
+  it_behaves_like "position formatter" do
+    let(:base_attrs) do
+      {
+        base_sha: 123,
+        start_sha: 456,
+        head_sha: 789,
+        old_path: 'old_image.png',
+        new_path: 'new_image.png',
+        position_type: 'image'
+      }
+    end
+
+    let(:attrs) do
+      base_attrs.merge(width: 100, height: 100, x: 1, y: 2)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/diff/formatters/text_formatter_spec.rb b/spec/lib/gitlab/diff/formatters/text_formatter_spec.rb
new file mode 100644
index 00000000000..897dc917f6a
--- /dev/null
+++ b/spec/lib/gitlab/diff/formatters/text_formatter_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe Gitlab::Diff::Formatters::TextFormatter do
+  let!(:base) do
+    {
+      base_sha: 123,
+      start_sha: 456,
+      head_sha: 789,
+      old_path: 'old_path.txt',
+      new_path: 'new_path.txt'
+    }
+  end
+
+  let!(:complete) do
+    base.merge(old_line: 1, new_line: 2)
+  end
+
+  it_behaves_like "position formatter" do
+    let(:base_attrs) { base }
+
+    let(:attrs) { complete }
+  end
+
+  # Specific text formatter examples
+  let!(:formatter) { described_class.new(attrs) }
+
+  describe '#line_age' do
+    subject { formatter.line_age }
+
+    context ' when there is only new_line' do
+      let(:attrs) { base.merge(new_line: 1) }
+
+      it { is_expected.to eq('new') }
+    end
+
+    context ' when there is only old_line' do
+      let(:attrs) { base.merge(old_line: 1) }
+
+      it { is_expected.to eq('old') }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/diff/position_spec.rb b/spec/lib/gitlab/diff/position_spec.rb
index 7798736a4dc..9bf54fdecc4 100644
--- a/spec/lib/gitlab/diff/position_spec.rb
+++ b/spec/lib/gitlab/diff/position_spec.rb
@@ -5,7 +5,7 @@ describe Gitlab::Diff::Position do
 
   let(:project) { create(:project, :repository) }
 
-  describe "position for an added file" do
+  describe "position for an added text file" do
     let(:commit) { project.commit("2ea1f3dec713d940208fb5ce4a38765ecb5d3f73") }
 
     subject do
@@ -47,6 +47,31 @@ describe Gitlab::Diff::Position do
     end
   end
 
+  describe "position for an added image file" do
+    let(:commit) { project.commit("33f3729a45c02fc67d00adb1b8bca394b0e761d9") }
+
+    subject do
+      described_class.new(
+        old_path: "files/images/6049019_460s.jpg",
+        new_path: "files/images/6049019_460s.jpg",
+        width: 100,
+        height: 100,
+        x: 1,
+        y: 100,
+        diff_refs: commit.diff_refs,
+        position_type: "image"
+      )
+    end
+
+    it "returns the correct diff file" do
+      diff_file = subject.diff_file(project.repository)
+
+      expect(diff_file.new_file?).to be true
+      expect(diff_file.new_path).to eq(subject.new_path)
+      expect(diff_file.diff_refs).to eq(subject.diff_refs)
+    end
+  end
+
   describe "position for a changed file" do
     let(:commit) { project.commit("570e7b2abdd848b95f2f578043fc23bd6f6fd24d") }
 
@@ -468,26 +493,54 @@ describe Gitlab::Diff::Position do
   end
 
   describe "#to_json" do
-    let(:hash) do
-      {
-        old_path: "files/ruby/popen.rb",
-        new_path: "files/ruby/popen.rb",
-        old_line: nil,
-        new_line: 14,
-        base_sha: nil,
-        head_sha: nil,
-        start_sha: nil
-      }
+    shared_examples "diff position json" do
+      it "returns the position as JSON" do
+        expect(JSON.parse(diff_position.to_json)).to eq(hash.stringify_keys)
+      end
+
+      it "works when nested under another hash" do
+        expect(JSON.parse(JSON.generate(pos: diff_position))).to eq('pos' => hash.stringify_keys)
+      end
     end
 
-    let(:diff_position) { described_class.new(hash) }
+    context "for text positon" do
+      let(:hash) do
+        {
+          old_path: "files/ruby/popen.rb",
+          new_path: "files/ruby/popen.rb",
+          old_line: nil,
+          new_line: 14,
+          base_sha: nil,
+          head_sha: nil,
+          start_sha: nil,
+          position_type: "text"
+        }
+      end
+
+      let(:diff_position) { described_class.new(hash) }
 
-    it "returns the position as JSON" do
-      expect(JSON.parse(diff_position.to_json)).to eq(hash.stringify_keys)
+      it_behaves_like "diff position json"
     end
 
-    it "works when nested under another hash" do
-      expect(JSON.parse(JSON.generate(pos: diff_position))).to eq('pos' => hash.stringify_keys)
+    context "for image positon" do
+      let(:hash) do
+        {
+          old_path: "files/any.img",
+          new_path: "files/any.img",
+          base_sha: nil,
+          head_sha: nil,
+          start_sha: nil,
+          width: 100,
+          height: 100,
+          x: 1,
+          y: 100,
+          position_type: "image"
+        }
+      end
+
+      let(:diff_position) { described_class.new(hash) }
+
+      it_behaves_like "diff position json"
     end
   end
 end
diff --git a/spec/lib/gitlab/diff/position_tracer_spec.rb b/spec/lib/gitlab/diff/position_tracer_spec.rb
index 4fa30d8df8b..e5138705443 100644
--- a/spec/lib/gitlab/diff/position_tracer_spec.rb
+++ b/spec/lib/gitlab/diff/position_tracer_spec.rb
@@ -71,6 +71,10 @@ describe Gitlab::Diff::PositionTracer do
     Gitlab::Diff::DiffRefs.new(base_sha: base_commit.id, head_sha: head_commit.id)
   end
 
+  def text_position_attrs
+    [:old_line, :new_line]
+  end
+
   def position(attrs = {})
     attrs.reverse_merge!(
       diff_refs: old_diff_refs
@@ -91,7 +95,11 @@ describe Gitlab::Diff::PositionTracer do
         expect(new_position.diff_refs).to eq(new_diff_refs)
 
         attrs.each do |attr, value|
-          expect(new_position.send(attr)).to eq(value)
+          if text_position_attrs.include?(attr)
+            expect(new_position.formatter.send(attr)).to eq(value)
+          else
+            expect(new_position.send(attr)).to eq(value)
+          end
         end
       end
     end
@@ -110,7 +118,11 @@ describe Gitlab::Diff::PositionTracer do
         expect(change_position.diff_refs).to eq(change_diff_refs)
 
         attrs.each do |attr, value|
-          expect(change_position.send(attr)).to eq(value)
+          if text_position_attrs.include?(attr)
+            expect(change_position.formatter.send(attr)).to eq(value)
+          else
+            expect(change_position.send(attr)).to eq(value)
+          end
         end
       end
     end
diff --git a/spec/models/diff_note_spec.rb b/spec/models/diff_note_spec.rb
index 4aa9ec789a3..eb0a3e9e0d3 100644
--- a/spec/models/diff_note_spec.rb
+++ b/spec/models/diff_note_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe DiffNote do
   include RepoHelpers
 
-  let(:merge_request) { create(:merge_request) }
+  let!(:merge_request) { create(:merge_request) }
   let(:project) { merge_request.project }
   let(:commit) { project.commit(sample_commit.id) }
 
@@ -98,14 +98,14 @@ describe DiffNote do
       diff_line = subject.diff_line
 
       expect(diff_line.added?).to be true
-      expect(diff_line.new_line).to eq(position.new_line)
+      expect(diff_line.new_line).to eq(position.formatter.new_line)
       expect(diff_line.text).to eq("+    vars = {")
     end
   end
 
   describe "#line_code" do
     it "returns the correct line code" do
-      line_code = Gitlab::Diff::LineCode.generate(position.file_path, position.new_line, 15)
+      line_code = Gitlab::Diff::LineCode.generate(position.file_path, position.formatter.new_line, 15)
 
       expect(subject.line_code).to eq(line_code)
     end
@@ -255,4 +255,38 @@ describe DiffNote do
       end
     end
   end
+
+  describe "image diff notes" do
+    let(:path) { "files/images/any_image.png" }
+
+    let!(:position) do
+      Gitlab::Diff::Position.new(
+        old_path: path,
+        new_path: path,
+        width: 10,
+        height: 10,
+        x: 1,
+        y: 1,
+        diff_refs: merge_request.diff_refs,
+        position_type: "image"
+      )
+    end
+
+    describe "validations" do
+      subject { build(:diff_note_on_merge_request, project: project, position: position, noteable: merge_request) }
+
+      it { is_expected.not_to validate_presence_of(:line_code) }
+
+      it "does not validate diff line" do
+        diff_line = subject.diff_line
+
+        expect(diff_line).to be nil
+        expect(subject).to be_valid
+      end
+    end
+
+    it "returns true for on_image?" do
+      expect(subject.on_image?).to be_truthy
+    end
+  end
 end
diff --git a/spec/models/note_spec.rb b/spec/models/note_spec.rb
index b214074fdce..1ecb50586c7 100644
--- a/spec/models/note_spec.rb
+++ b/spec/models/note_spec.rb
@@ -314,6 +314,56 @@ describe Note do
         expect(subject[active_diff_note1.line_code].first.id).to eq(active_diff_note1.discussion_id)
         expect(subject[active_diff_note3.line_code].first.id).to eq(active_diff_note3.discussion_id)
       end
+
+      context 'with image discussions' do
+        let(:merge_request2) { create(:merge_request_with_diffs, :with_image_diffs, source_project: project, title: "Added images and changes") }
+        let(:image_path) { "files/images/ee_repo_logo.png" }
+        let(:text_path) { "bar/branch-test.txt" }
+        let!(:image_note) { create(:diff_note_on_merge_request, project: project, noteable: merge_request2, position: image_position) }
+        let!(:text_note) { create(:diff_note_on_merge_request, project: project, noteable: merge_request2, position: text_position) }
+
+        let(:image_position) do
+          Gitlab::Diff::Position.new(
+            old_path: image_path,
+            new_path: image_path,
+            width: 100,
+            height: 100,
+            x: 1,
+            y: 1,
+            position_type: "image",
+            diff_refs: merge_request2.diff_refs
+          )
+        end
+
+        let(:text_position) do
+          Gitlab::Diff::Position.new(
+            old_path: text_path,
+            new_path: text_path,
+            old_line: nil,
+            new_line: 2,
+            position_type: "text",
+            diff_refs: merge_request2.diff_refs
+          )
+        end
+
+        it "groups image discussions by file identifier" do
+          diff_discussion = DiffDiscussion.new([image_note])
+
+          discussions = merge_request2.notes.grouped_diff_discussions
+
+          expect(discussions.size).to eq(2)
+          expect(discussions[image_note.diff_file.new_path]).to include(diff_discussion)
+        end
+
+        it "groups text discussions by line code" do
+          diff_discussion = DiffDiscussion.new([text_note])
+
+          discussions = merge_request2.notes.grouped_diff_discussions
+
+          expect(discussions.size).to eq(2)
+          expect(discussions[text_note.line_code]).to include(diff_discussion)
+        end
+      end
     end
 
     context 'diff discussions for older diff refs' do
diff --git a/spec/services/discussions/update_diff_position_service_spec.rb b/spec/services/discussions/update_diff_position_service_spec.rb
index 82b156f5ebe..2b84206318f 100644
--- a/spec/services/discussions/update_diff_position_service_spec.rb
+++ b/spec/services/discussions/update_diff_position_service_spec.rb
@@ -164,8 +164,8 @@ describe Discussions::UpdateDiffPositionService do
         change_position = discussion.change_position
         expect(change_position.start_sha).to eq(old_diff_refs.head_sha)
         expect(change_position.head_sha).to eq(new_diff_refs.head_sha)
-        expect(change_position.old_line).to eq(9)
-        expect(change_position.new_line).to be_nil
+        expect(change_position.formatter.old_line).to eq(9)
+        expect(change_position.formatter.new_line).to be_nil
       end
 
       it 'creates a system discussion' do
@@ -184,7 +184,7 @@ describe Discussions::UpdateDiffPositionService do
 
         expect(discussion.original_position).to eq(old_position)
         expect(discussion.position).not_to eq(old_position)
-        expect(discussion.position.new_line).to eq(22)
+        expect(discussion.position.formatter.new_line).to eq(22)
       end
 
       context 'when the resolve_outdated_diff_discussions setting is set' do
diff --git a/spec/support/features/discussion_comments_shared_example.rb b/spec/support/features/discussion_comments_shared_example.rb
index 81cb94ab8c4..9f05cabf7ae 100644
--- a/spec/support/features/discussion_comments_shared_example.rb
+++ b/spec/support/features/discussion_comments_shared_example.rb
@@ -71,7 +71,7 @@ shared_examples 'discussion comments' do |resource_name|
       expect(page).not_to have_selector menu_selector
 
       find(toggle_selector).click
-      find('body').click
+      find('body').trigger 'click'
 
       expect(page).not_to have_selector menu_selector
     end
diff --git a/spec/support/shared_examples/position_formatters.rb b/spec/support/shared_examples/position_formatters.rb
new file mode 100644
index 00000000000..ffc9456dbc7
--- /dev/null
+++ b/spec/support/shared_examples/position_formatters.rb
@@ -0,0 +1,43 @@
+shared_examples_for "position formatter" do
+  let(:formatter) { described_class.new(attrs) }
+
+  describe '#key' do
+    let(:key) { [123, 456, 789, Digest::SHA1.hexdigest(formatter.old_path), Digest::SHA1.hexdigest(formatter.new_path), 1, 2] }
+
+    subject { formatter.key }
+
+    it { is_expected.to eq(key) }
+  end
+
+  describe '#complete?' do
+    subject { formatter.complete? }
+
+    context 'when there are missing key attributes' do
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when old_line and new_line are nil' do
+      let(:attrs) { base_attrs }
+
+      it { is_expected.to be_falsy }
+    end
+  end
+
+  describe '#to_h' do
+    let(:formatter_hash) do
+      attrs.merge(position_type: base_attrs[:position_type] || 'text' )
+    end
+
+    subject { formatter.to_h }
+
+    it { is_expected.to eq(formatter_hash) }
+  end
+
+  describe '#==' do
+    subject { formatter }
+
+    let(:other_formatter) { described_class.new(attrs) }
+
+    it { is_expected.to eq(other_formatter) }
+  end
+end
diff --git a/spec/support/test_env.rb b/spec/support/test_env.rb
index 79395f4c564..a27bfdee3d2 100644
--- a/spec/support/test_env.rb
+++ b/spec/support/test_env.rb
@@ -46,7 +46,8 @@ module TestEnv
     'v1.1.0'                             => 'b83d6e3',
     'add-ipython-files'                  => '93ee732',
     'add-pdf-file'                       => 'e774ebd',
-    'add-pdf-text-binary'                => '79faa7b'
+    'add-pdf-text-binary'                => '79faa7b',
+    'add_images_and_changes'             => '010d106'
   }.freeze
 
   # gitlab-test-fork is a fork of gitlab-fork, but we don't necessarily
-- 
cgit v1.2.1


From 20727db1702849b78e6714197f16f602f68cecf8 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Thu, 28 Sep 2017 15:34:09 +0200
Subject: Add a model for `fork_networks`

The fork network will keep track of the root project as long as it's
present.
---
 app/models/fork_network.rb                        |  3 +++
 db/migrate/20170928124105_create_fork_networks.rb | 28 +++++++++++++++++++++++
 db/schema.rb                                      |  8 +++++++
 spec/lib/gitlab/import_export/all_models.yml      |  3 +++
 spec/models/fork_network_spec.rb                  |  5 ++++
 5 files changed, 47 insertions(+)
 create mode 100644 app/models/fork_network.rb
 create mode 100644 db/migrate/20170928124105_create_fork_networks.rb
 create mode 100644 spec/models/fork_network_spec.rb

diff --git a/app/models/fork_network.rb b/app/models/fork_network.rb
new file mode 100644
index 00000000000..60c8c167b21
--- /dev/null
+++ b/app/models/fork_network.rb
@@ -0,0 +1,3 @@
+class ForkNetwork < ActiveRecord::Base
+  belongs_to :root_project
+end
diff --git a/db/migrate/20170928124105_create_fork_networks.rb b/db/migrate/20170928124105_create_fork_networks.rb
new file mode 100644
index 00000000000..ca906b953a3
--- /dev/null
+++ b/db/migrate/20170928124105_create_fork_networks.rb
@@ -0,0 +1,28 @@
+class CreateForkNetworks < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    create_table :fork_networks do |t|
+      t.references :root_project,
+                   references: :projects,
+                   index: { unique: true }
+
+      t.string :deleted_root_project_name
+    end
+
+    add_concurrent_foreign_key :fork_networks, :projects,
+                               column: :root_project_id,
+                               on_delete: :nullify
+  end
+
+  def down
+    if foreign_keys_for(:fork_networks, :root_project_id).any?
+      remove_foreign_key :fork_networks, column: :root_project_id
+    end
+    drop_table :fork_networks
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 25aa15b837f..d7e1a2c94fa 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -591,6 +591,13 @@ ActiveRecord::Schema.define(version: 20171006091000) do
 
   add_index "features", ["key"], name: "index_features_on_key", unique: true, using: :btree
 
+  create_table "fork_networks", force: :cascade do |t|
+    t.integer "root_project_id"
+    t.string "deleted_root_project_name"
+  end
+
+  add_index "fork_networks", ["root_project_id"], name: "index_fork_networks_on_root_project_id", unique: true, using: :btree
+
   create_table "forked_project_links", force: :cascade do |t|
     t.integer "forked_to_project_id", null: false
     t.integer "forked_from_project_id", null: false
@@ -1793,6 +1800,7 @@ ActiveRecord::Schema.define(version: 20171006091000) do
   add_foreign_key "environments", "projects", name: "fk_d1c8c1da6a", on_delete: :cascade
   add_foreign_key "events", "projects", on_delete: :cascade
   add_foreign_key "events", "users", column: "author_id", name: "fk_edfd187b6f", on_delete: :cascade
+  add_foreign_key "fork_networks", "projects", column: "root_project_id", name: "fk_e7b436b2b5", on_delete: :nullify
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
   add_foreign_key "gcp_clusters", "projects", on_delete: :cascade
   add_foreign_key "gcp_clusters", "services", on_delete: :nullify
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index c457bda9dcb..29baa70d5ae 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -272,6 +272,9 @@ project:
 - uploads
 - members_and_requesters
 - build_trace_section_names
+- root_of_fork_network
+- fork_network_member
+- fork_network
 award_emoji:
 - awardable
 - user
diff --git a/spec/models/fork_network_spec.rb b/spec/models/fork_network_spec.rb
new file mode 100644
index 00000000000..b7758a0fbb5
--- /dev/null
+++ b/spec/models/fork_network_spec.rb
@@ -0,0 +1,5 @@
+require 'rails_helper'
+
+RSpec.describe ForkNetwork, type: :model do
+  pending "add some examples to (or delete) #{__FILE__}"
+end
-- 
cgit v1.2.1


From d328007214786c7137c31d2c73e9ee76b025e6ed Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Thu, 28 Sep 2017 16:38:12 +0200
Subject: Create a fork network when forking a project

When no fork network exists for the source projects, we create a new
one with the correct source
---
 app/models/fork_network.rb                         | 10 ++++-
 app/models/fork_network_member.rb                  |  7 ++++
 app/models/project.rb                              | 13 ++++++-
 app/services/projects/fork_service.rb              | 20 ++++++++++
 .../20170928133643_create_fork_network_members.rb  | 26 +++++++++++++
 db/schema.rb                                       | 12 ++++++
 spec/models/fork_network_member_spec.rb            |  8 ++++
 spec/models/fork_network_spec.rb                   | 43 ++++++++++++++++++++--
 spec/services/projects/fork_service_spec.rb        | 27 ++++++++++++++
 9 files changed, 160 insertions(+), 6 deletions(-)
 create mode 100644 app/models/fork_network_member.rb
 create mode 100644 db/migrate/20170928133643_create_fork_network_members.rb
 create mode 100644 spec/models/fork_network_member_spec.rb

diff --git a/app/models/fork_network.rb b/app/models/fork_network.rb
index 60c8c167b21..fd2510d0a4c 100644
--- a/app/models/fork_network.rb
+++ b/app/models/fork_network.rb
@@ -1,3 +1,11 @@
 class ForkNetwork < ActiveRecord::Base
-  belongs_to :root_project
+  belongs_to :root_project, class_name: 'Project'
+  has_many :fork_network_members
+  has_many :projects, through: :fork_network_members
+
+  after_create :add_root_as_member, if: :root_project
+
+  def add_root_as_member
+    projects << root_project
+  end
 end
diff --git a/app/models/fork_network_member.rb b/app/models/fork_network_member.rb
new file mode 100644
index 00000000000..6a9b52a1ef8
--- /dev/null
+++ b/app/models/fork_network_member.rb
@@ -0,0 +1,7 @@
+class ForkNetworkMember < ActiveRecord::Base
+  belongs_to :fork_network
+  belongs_to :project
+  belongs_to :forked_from_project, class_name: 'Project'
+
+  validates :fork_network, :project, presence: true
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index 608b545f99f..aff8fd768f5 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -118,11 +118,20 @@ class Project < ActiveRecord::Base
   has_one :mock_monitoring_service
   has_one :microsoft_teams_service
 
+  # TODO: replace these relations with the fork network versions
   has_one  :forked_project_link,  foreign_key: "forked_to_project_id"
   has_one  :forked_from_project,  through:   :forked_project_link
 
   has_many :forked_project_links, foreign_key: "forked_from_project_id"
   has_many :forks,                through:     :forked_project_links, source: :forked_to_project
+  # TODO: replace these relations with the fork network versions
+
+  has_one :root_of_fork_network,
+          foreign_key: 'root_project_id',
+          inverse_of: :root_project,
+          class_name: 'ForkNetwork'
+  has_one :fork_network_member
+  has_one :fork_network, through: :fork_network_member
 
   # Merge Requests for target project should be removed with it
   has_many :merge_requests, foreign_key: 'target_project_id'
@@ -1119,8 +1128,8 @@ class Project < ActiveRecord::Base
     end
   end
 
-  def forked_from?(project)
-    forked? && project == forked_from_project
+  def in_fork_network_of?(project)
+    forked? && project.fork_network == fork_network
   end
 
   def origin_merge_requests
diff --git a/app/services/projects/fork_service.rb b/app/services/projects/fork_service.rb
index ad67e68a86a..eb5cce5ab98 100644
--- a/app/services/projects/fork_service.rb
+++ b/app/services/projects/fork_service.rb
@@ -23,11 +23,31 @@ module Projects
 
       refresh_forks_count
 
+      link_fork_network(new_project)
+
       new_project
     end
 
     private
 
+    def fork_network
+      if @project.fork_network
+        @project.fork_network
+      elsif forked_from_project = @project.forked_from_project
+        # TODO: remove this case when all background migrations have completed
+        # this only happens when a project had a `forked_project_link` that was
+        # not migrated to the `fork_network` relation
+        forked_from_project.fork_network || forked_from_project.create_root_of_fork_network
+      else
+        @project.create_root_of_fork_network
+      end
+    end
+
+    def link_fork_network(new_project)
+      fork_network.fork_network_members.create(project: new_project,
+                                               forked_from_project: @project)
+    end
+
     def refresh_forks_count
       Projects::ForksCountService.new(@project).refresh_cache
     end
diff --git a/db/migrate/20170928133643_create_fork_network_members.rb b/db/migrate/20170928133643_create_fork_network_members.rb
new file mode 100644
index 00000000000..c1d94e7d52e
--- /dev/null
+++ b/db/migrate/20170928133643_create_fork_network_members.rb
@@ -0,0 +1,26 @@
+class CreateForkNetworkMembers < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    create_table :fork_network_members do |t|
+      t.references :fork_network, null: false, index: true, foreign_key: { on_delete: :cascade }
+      t.references :project, null: false, index: { unique: true }, foreign_key: { on_delete: :cascade }
+      t.references :forked_from_project, references: :projects
+    end
+
+    add_concurrent_foreign_key :fork_network_members, :projects,
+                               column: :forked_from_project_id,
+                               on_delete: :nullify
+  end
+
+  def down
+    if foreign_key_exists?(:fork_network_members, column: :forked_from_project_id)
+      remove_foreign_key :fork_network_members, column: :forked_from_project_id
+    end
+    drop_table :fork_network_members
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index d7e1a2c94fa..aac37b6b455 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -591,6 +591,15 @@ ActiveRecord::Schema.define(version: 20171006091000) do
 
   add_index "features", ["key"], name: "index_features_on_key", unique: true, using: :btree
 
+  create_table "fork_network_members", force: :cascade do |t|
+    t.integer "fork_network_id", null: false
+    t.integer "project_id", null: false
+    t.integer "forked_from_project_id"
+  end
+
+  add_index "fork_network_members", ["fork_network_id"], name: "index_fork_network_members_on_fork_network_id", using: :btree
+  add_index "fork_network_members", ["project_id"], name: "index_fork_network_members_on_project_id", unique: true, using: :btree
+
   create_table "fork_networks", force: :cascade do |t|
     t.integer "root_project_id"
     t.string "deleted_root_project_name"
@@ -1800,6 +1809,9 @@ ActiveRecord::Schema.define(version: 20171006091000) do
   add_foreign_key "environments", "projects", name: "fk_d1c8c1da6a", on_delete: :cascade
   add_foreign_key "events", "projects", on_delete: :cascade
   add_foreign_key "events", "users", column: "author_id", name: "fk_edfd187b6f", on_delete: :cascade
+  add_foreign_key "fork_network_members", "fork_networks", on_delete: :cascade
+  add_foreign_key "fork_network_members", "projects", column: "forked_from_project_id", name: "fk_b01280dae4", on_delete: :nullify
+  add_foreign_key "fork_network_members", "projects", on_delete: :cascade
   add_foreign_key "fork_networks", "projects", column: "root_project_id", name: "fk_e7b436b2b5", on_delete: :nullify
   add_foreign_key "forked_project_links", "projects", column: "forked_to_project_id", name: "fk_434510edb0", on_delete: :cascade
   add_foreign_key "gcp_clusters", "projects", on_delete: :cascade
diff --git a/spec/models/fork_network_member_spec.rb b/spec/models/fork_network_member_spec.rb
new file mode 100644
index 00000000000..532ca1fca8c
--- /dev/null
+++ b/spec/models/fork_network_member_spec.rb
@@ -0,0 +1,8 @@
+require 'spec_helper'
+
+describe ForkNetworkMember do
+  describe 'validations' do
+    it { is_expected.to validate_presence_of(:project) }
+    it { is_expected.to validate_presence_of(:fork_network) }
+  end
+end
diff --git a/spec/models/fork_network_spec.rb b/spec/models/fork_network_spec.rb
index b7758a0fbb5..4781a959846 100644
--- a/spec/models/fork_network_spec.rb
+++ b/spec/models/fork_network_spec.rb
@@ -1,5 +1,42 @@
-require 'rails_helper'
+require 'spec_helper'
 
-RSpec.describe ForkNetwork, type: :model do
-  pending "add some examples to (or delete) #{__FILE__}"
+describe ForkNetwork do
+  include ProjectForksHelper
+
+  describe '#add_root_as_member' do
+    it 'adds the root project as a member when creating a new root network' do
+      project = create(:project)
+      fork_network = described_class.create(root_project: project)
+
+      expect(fork_network.projects).to include(project)
+    end
+  end
+
+  context 'for a deleted project' do
+    it 'keeps the fork network' do
+      project = create(:project, :public)
+      forked = fork_project(project)
+      project.destroy!
+
+      fork_network = forked.reload.fork_network
+
+      expect(fork_network.projects).to contain_exactly(forked)
+      expect(fork_network.root_project).to be_nil
+    end
+
+    it 'allows multiple fork networks where the root project is deleted' do
+      first_project = create(:project)
+      second_project = create(:project)
+      first_fork = fork_project(first_project)
+      second_fork = fork_project(second_project)
+
+      first_project.destroy
+      second_project.destroy
+
+      expect(first_fork.fork_network).not_to be_nil
+      expect(first_fork.fork_network.root_project).to be_nil
+      expect(second_fork.fork_network).not_to be_nil
+      expect(second_fork.fork_network.root_project).to be_nil
+    end
+  end
 end
diff --git a/spec/services/projects/fork_service_spec.rb b/spec/services/projects/fork_service_spec.rb
index fa9d6969830..a5ec4111b70 100644
--- a/spec/services/projects/fork_service_spec.rb
+++ b/spec/services/projects/fork_service_spec.rb
@@ -60,6 +60,33 @@ describe Projects::ForkService do
 
           expect(@from_project.forks_count).to eq(1)
         end
+
+        it 'creates a fork network with the new project and the root project set' do
+          to_project
+          fork_network = @from_project.reload.fork_network
+
+          expect(fork_network).not_to be_nil
+          expect(fork_network.root_project).to eq(@from_project)
+          expect(fork_network.projects).to contain_exactly(@from_project, to_project)
+        end
+      end
+
+      context 'creating a fork of a fork' do
+        let(:from_forked_project) { fork_project(@from_project, @to_user) }
+        let(:other_namespace) do
+          group = create(:group)
+          group.add_owner(@to_user)
+          group
+        end
+        let(:to_project) { fork_project(from_forked_project, @to_user, namespace: other_namespace) }
+
+        it 'sets the root of the network to the root project' do
+          expect(to_project.fork_network.root_project).to eq(@from_project)
+        end
+
+        it 'sets the forked_from_project on the membership' do
+          expect(to_project.fork_network_member.forked_from_project).to eq(from_forked_project)
+        end
       end
     end
 
-- 
cgit v1.2.1


From 70716a1292ca5910908ba37a9d113c8b5a221bb7 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Wed, 20 Sep 2017 17:41:11 +0200
Subject: Allow creating merge requests across forks of a project

---
 app/finders/merge_request_target_project_finder.rb | 18 +++++++
 app/helpers/merge_requests_helper.rb               |  3 +-
 app/models/merge_request.rb                        |  2 +-
 app/models/project.rb                              | 15 +++++-
 changelogs/unreleased/bvl-fork-network-schema.yml  |  5 ++
 .../20170928133643_create_fork_network_members.rb  |  2 +-
 lib/gitlab/closing_issue_extractor.rb              |  3 +-
 .../merge_requests/create_new_mr_from_fork_spec.rb | 60 ++++++++++++++++++++++
 .../merge_request_target_project_finder_spec.rb    | 54 +++++++++++++++++++
 spec/models/merge_request_spec.rb                  | 17 +++++-
 spec/models/project_spec.rb                        | 59 +++++++++++++++++++++
 spec/requests/api/merge_requests_spec.rb           | 10 ----
 spec/requests/api/v3/merge_requests_spec.rb        | 10 ----
 13 files changed, 230 insertions(+), 28 deletions(-)
 create mode 100644 app/finders/merge_request_target_project_finder.rb
 create mode 100644 changelogs/unreleased/bvl-fork-network-schema.yml
 create mode 100644 spec/features/merge_requests/create_new_mr_from_fork_spec.rb
 create mode 100644 spec/finders/merge_request_target_project_finder_spec.rb

diff --git a/app/finders/merge_request_target_project_finder.rb b/app/finders/merge_request_target_project_finder.rb
new file mode 100644
index 00000000000..508b53a52c1
--- /dev/null
+++ b/app/finders/merge_request_target_project_finder.rb
@@ -0,0 +1,18 @@
+class MergeRequestTargetProjectFinder
+  attr_reader :current_user, :source_project
+
+  def initialize(current_user: nil, source_project:, params: {})
+    @current_user = current_user
+    @source_project = source_project
+  end
+
+  def execute
+    if @source_project.fork_network
+      @source_project.fork_network.projects
+        .public_or_visible_to_user(current_user)
+        .with_feature_available_for_user(:merge_requests, current_user)
+    else
+      Project.where(id: source_project)
+    end
+  end
+end
diff --git a/app/helpers/merge_requests_helper.rb b/app/helpers/merge_requests_helper.rb
index c31023f2d9a..5b2c58d193d 100644
--- a/app/helpers/merge_requests_helper.rb
+++ b/app/helpers/merge_requests_helper.rb
@@ -73,7 +73,8 @@ module MergeRequestsHelper
   end
 
   def target_projects(project)
-    [project, project.default_merge_request_target].uniq
+    MergeRequestTargetProjectFinder.new(current_user: current_user, source_project: project)
+      .execute
   end
 
   def merge_request_button_visibility(merge_request, closed)
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 086226618e6..9b312f7db6c 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -403,7 +403,7 @@ class MergeRequest < ActiveRecord::Base
     return false unless for_fork?
     return true unless source_project
 
-    !source_project.forked_from?(target_project)
+    !source_project.in_fork_network_of?(target_project)
   end
 
   def reopenable?
diff --git a/app/models/project.rb b/app/models/project.rb
index aff8fd768f5..4a883552a8d 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1128,8 +1128,19 @@ class Project < ActiveRecord::Base
     end
   end
 
-  def in_fork_network_of?(project)
-    forked? && project.fork_network == fork_network
+  def forked_from?(other_project)
+    forked? && forked_from_project == other_project
+  end
+
+  def in_fork_network_of?(other_project)
+    # TODO: Remove this in a next release when all fork_networks are populated
+    # This makes sure all MergeRequests remain valid while the projects don't
+    # have a fork_network yet.
+    return true if forked_from?(other_project)
+
+    return false if fork_network.nil? || other_project.fork_network.nil?
+
+    fork_network == other_project.fork_network
   end
 
   def origin_merge_requests
diff --git a/changelogs/unreleased/bvl-fork-network-schema.yml b/changelogs/unreleased/bvl-fork-network-schema.yml
new file mode 100644
index 00000000000..97b2d5acada
--- /dev/null
+++ b/changelogs/unreleased/bvl-fork-network-schema.yml
@@ -0,0 +1,5 @@
+---
+title: Allow creating merge requests across a fork network
+merge_request: 14422
+author:
+type: changed
diff --git a/db/migrate/20170928133643_create_fork_network_members.rb b/db/migrate/20170928133643_create_fork_network_members.rb
index c1d94e7d52e..836f023efdc 100644
--- a/db/migrate/20170928133643_create_fork_network_members.rb
+++ b/db/migrate/20170928133643_create_fork_network_members.rb
@@ -18,7 +18,7 @@ class CreateForkNetworkMembers < ActiveRecord::Migration
   end
 
   def down
-    if foreign_key_exists?(:fork_network_members, column: :forked_from_project_id)
+    if foreign_keys_for(:fork_network_members, :forked_from_project_id).any?
       remove_foreign_key :fork_network_members, column: :forked_from_project_id
     end
     drop_table :fork_network_members
diff --git a/lib/gitlab/closing_issue_extractor.rb b/lib/gitlab/closing_issue_extractor.rb
index 243c1f1394d..7e7aaeeaa17 100644
--- a/lib/gitlab/closing_issue_extractor.rb
+++ b/lib/gitlab/closing_issue_extractor.rb
@@ -23,7 +23,8 @@ module Gitlab
       @extractor.analyze(closing_statements.join(" "))
 
       @extractor.issues.reject do |issue|
-        @extractor.project.forked_from?(issue.project) # Don't extract issues on original project
+        # Don't extract issues from the project this project was forked from
+        @extractor.project.forked_from?(issue.project)
       end
     end
   end
diff --git a/spec/features/merge_requests/create_new_mr_from_fork_spec.rb b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
new file mode 100644
index 00000000000..515818c5d42
--- /dev/null
+++ b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
@@ -0,0 +1,60 @@
+require 'spec_helper'
+
+feature 'Creating a merge request from a fork', :js do
+  let(:user) { create(:user) }
+  let(:project) { create(:project, :public, :repository) }
+  let!(:source_project) { ::Projects::ForkService.new(project, user).execute }
+
+  before do
+    source_project.add_master(user)
+
+    sign_in(user)
+  end
+
+  shared_examples 'create merge request to other project' do
+    it 'has all possible target projects' do
+      visit project_new_merge_request_path(source_project)
+
+      first('.js-target-project').click
+
+      within('.dropdown-target-project .dropdown-content') do
+        expect(page).to have_content(project.full_path)
+        expect(page).to have_content(target_project.full_path)
+        expect(page).to have_content(source_project.full_path)
+      end
+    end
+
+    it 'allows creating the merge request to another target project' do
+      visit project_merge_requests_path(source_project)
+
+      page.within '.content' do
+        click_link 'New merge request'
+      end
+
+      find('.js-source-branch', match: :first).click
+      find('.dropdown-source-branch .dropdown-content a', match: :first).click
+
+      first('.js-target-project').click
+      find('.dropdown-target-project .dropdown-content a', text: target_project.full_path).click
+
+      click_button 'Compare branches and continue'
+
+      wait_for_requests
+
+      expect { click_button 'Submit merge request' }
+        .to change { target_project.merge_requests.reload.size }.by(1)
+    end
+  end
+
+  context 'creating to the source of a fork' do
+    let(:target_project) { project }
+
+    it_behaves_like('create merge request to other project')
+  end
+
+  context 'creating to a sibling of a fork' do
+    let!(:target_project) { ::Projects::ForkService.new(project, create(:user)).execute }
+
+    it_behaves_like('create merge request to other project')
+  end
+end
diff --git a/spec/finders/merge_request_target_project_finder_spec.rb b/spec/finders/merge_request_target_project_finder_spec.rb
new file mode 100644
index 00000000000..c81bfd7932c
--- /dev/null
+++ b/spec/finders/merge_request_target_project_finder_spec.rb
@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe MergeRequestTargetProjectFinder do
+  include ProjectForksHelper
+
+  let(:user) { create(:user) }
+  subject(:finder) { described_class.new(current_user: user, source_project: forked_project) }
+
+  shared_examples 'finding related projects' do
+    it 'finds sibling projects and base project'  do
+      other_fork
+
+      expect(finder.execute).to contain_exactly(base_project, other_fork, forked_project)
+    end
+
+    it 'does not include projects that have merge requests turned off' do
+      other_fork.project_feature.update!(merge_requests_access_level: ProjectFeature::DISABLED)
+      base_project.project_feature.update!(merge_requests_access_level: ProjectFeature::DISABLED)
+
+      expect(finder.execute).to contain_exactly(forked_project)
+    end
+  end
+
+  context 'public projects' do
+    let(:base_project) { create(:project, :public, path: 'base') }
+    let(:forked_project) { fork_project(base_project) }
+    let(:other_fork) { fork_project(base_project) }
+
+    it_behaves_like 'finding related projects'
+  end
+
+  context 'private projects' do
+    let(:base_project) { create(:project, :private, path: 'base') }
+    let(:forked_project) { fork_project(base_project, base_project.owner) }
+    let(:other_fork) { fork_project(base_project, base_project.owner) }
+
+    context 'when the user is a member of all projects' do
+      before do
+        base_project.add_developer(user)
+        forked_project.add_developer(user)
+        other_fork.add_developer(user)
+      end
+
+      it_behaves_like 'finding related projects'
+    end
+
+    it 'only finds the projects the user is a member of' do
+      other_fork.add_developer(user)
+      base_project.add_developer(user)
+
+      expect(finder.execute).to contain_exactly(other_fork, base_project)
+    end
+  end
+end
diff --git a/spec/models/merge_request_spec.rb b/spec/models/merge_request_spec.rb
index 188a0a98ec3..5f3e3c05d78 100644
--- a/spec/models/merge_request_spec.rb
+++ b/spec/models/merge_request_spec.rb
@@ -49,6 +49,19 @@ describe MergeRequest do
         expect(subject).to be_valid
       end
     end
+
+    context 'for forks' do
+      let(:project) { create(:project) }
+      let(:fork1) { create(:forked_project_link, forked_from_project: project).forked_to_project }
+      let(:fork2) { create(:forked_project_link, forked_from_project: project).forked_to_project }
+
+      it 'allows merge requests for sibling-forks' do
+        subject.source_project = fork1
+        subject.target_project = fork2
+
+        expect(subject).to be_valid
+      end
+    end
   end
 
   describe 'respond to' do
@@ -1425,7 +1438,7 @@ describe MergeRequest do
 
   describe "#source_project_missing?" do
     let(:project)      { create(:project) }
-    let(:fork_project) { create(:project, forked_from_project: project) }
+    let(:fork_project) { create(:forked_project_link, forked_from_project: project).forked_to_project }
     let(:user)         { create(:user) }
     let(:unlink_project) { Projects::UnlinkForkService.new(fork_project, user) }
 
@@ -1446,7 +1459,7 @@ describe MergeRequest do
     end
 
     context "when the fork does not exist" do
-      let(:merge_request) do
+      let!(:merge_request) do
         create(:merge_request,
           source_project: fork_project,
           target_project: project)
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 760ea7da322..40b64cad475 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -1818,6 +1818,65 @@ describe Project do
     end
   end
 
+  context 'forks' do
+    let(:project) { create(:project, :public) }
+    let!(:forked_project) { fork_project(project) }
+
+    def fork_project(project)
+      Projects::ForkService.new(project, create(:user)).execute
+    end
+
+    describe '#fork_network' do
+      it 'includes a fork of the project' do
+        expect(project.fork_network).to include(forked_project)
+      end
+
+      it 'includes a fork of a fork' do
+        other_fork = fork_project(forked_project)
+
+        expect(project.fork_network).to include(other_fork)
+      end
+
+      it 'includes sibling forks' do
+        other_fork = fork_project(project)
+
+        expect(forked_project.fork_network).to include(other_fork)
+      end
+
+      it 'includes the base project' do
+        expect(forked_project.fork_network).to include(project)
+      end
+    end
+
+    describe '#in_fork_network_of?' do
+      it 'is false when the project is not a fork' do
+        expect(project.in_fork_network_of?(double)).to be_falsy
+      end
+
+      it 'is true for a real fork' do
+        expect(forked_project.in_fork_network_of?(project)).to be_truthy
+      end
+
+      it 'is true for a fork of a fork', :postgresql do
+        other_fork = fork_project(forked_project)
+
+        expect(other_fork.in_fork_network_of?(project)).to be_truthy
+      end
+
+      it 'is true for sibling forks' do
+        sibling = fork_project(project)
+
+        expect(sibling.in_fork_network_of?(forked_project)).to be_truthy
+      end
+
+      it 'is false when another project is given' do
+        other_project = build_stubbed(:project)
+
+        expect(forked_project.in_fork_network_of?(other_project)).to be_falsy
+      end
+    end
+  end
+
   describe '#pushes_since_gc' do
     let(:project) { create(:project) }
 
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index c4f6e97b915..377d1a8f877 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -676,16 +676,6 @@ describe API::MergeRequests do
       end
 
       context 'when target_branch is specified' do
-        it 'returns 422 if not a forked project' do
-          post api("/projects/#{project.id}/merge_requests", user),
-               title: 'Test merge_request',
-               target_branch: 'master',
-               source_branch: 'markdown',
-               author: user,
-               target_project_id: fork_project.id
-          expect(response).to have_gitlab_http_status(422)
-        end
-
         it 'returns 422 if targeting a different fork' do
           post api("/projects/#{fork_project.id}/merge_requests", user2),
                title: 'Test merge_request',
diff --git a/spec/requests/api/v3/merge_requests_spec.rb b/spec/requests/api/v3/merge_requests_spec.rb
index 86f38dd4ec1..acd53fbff66 100644
--- a/spec/requests/api/v3/merge_requests_spec.rb
+++ b/spec/requests/api/v3/merge_requests_spec.rb
@@ -372,16 +372,6 @@ describe API::MergeRequests do
       end
 
       context 'when target_branch is specified' do
-        it 'returns 422 if not a forked project' do
-          post v3_api("/projects/#{project.id}/merge_requests", user),
-               title: 'Test merge_request',
-               target_branch: 'master',
-               source_branch: 'markdown',
-               author: user,
-               target_project_id: fork_project.id
-          expect(response).to have_gitlab_http_status(422)
-        end
-
         it 'returns 422 if targeting a different fork' do
           post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
                title: 'Test merge_request',
-- 
cgit v1.2.1


From 7c00b53812895970fdb00cf1d27b059bb15815cd Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Thu, 21 Sep 2017 18:34:32 +0200
Subject: Find branches in all projects in the fork network

---
 .../projects/merge_requests/creations_controller.rb   |  7 +++++--
 app/finders/merge_request_target_project_finder.rb    |  2 +-
 .../merge_requests/create_new_mr_from_fork_spec.rb    | 19 +++++++++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/app/controllers/projects/merge_requests/creations_controller.rb b/app/controllers/projects/merge_requests/creations_controller.rb
index 1096afbb798..99dc3dda9e7 100644
--- a/app/controllers/projects/merge_requests/creations_controller.rb
+++ b/app/controllers/projects/merge_requests/creations_controller.rb
@@ -120,10 +120,13 @@ class Projects::MergeRequests::CreationsController < Projects::MergeRequests::Ap
   end
 
   def selected_target_project
-    if @project.id.to_s == params[:target_project_id] || @project.forked_project_link.nil?
+    if @project.id.to_s == params[:target_project_id] || !@project.forked?
       @project
+    elsif params[:target_project_id].present?
+      MergeRequestTargetProjectFinder.new(current_user: current_user, source_project: @project)
+        .execute.find(params[:target_project_id])
     else
-      @project.forked_project_link.forked_from_project
+      @project.forked_from_project
     end
   end
 end
diff --git a/app/finders/merge_request_target_project_finder.rb b/app/finders/merge_request_target_project_finder.rb
index 508b53a52c1..189eb3847eb 100644
--- a/app/finders/merge_request_target_project_finder.rb
+++ b/app/finders/merge_request_target_project_finder.rb
@@ -1,7 +1,7 @@
 class MergeRequestTargetProjectFinder
   attr_reader :current_user, :source_project
 
-  def initialize(current_user: nil, source_project:, params: {})
+  def initialize(current_user: nil, source_project:)
     @current_user = current_user
     @source_project = source_project
   end
diff --git a/spec/features/merge_requests/create_new_mr_from_fork_spec.rb b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
index 515818c5d42..e6f827174e2 100644
--- a/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
+++ b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
@@ -44,6 +44,25 @@ feature 'Creating a merge request from a fork', :js do
       expect { click_button 'Submit merge request' }
         .to change { target_project.merge_requests.reload.size }.by(1)
     end
+
+    it 'updates the branches when selecting a new target project' do
+      target_project_member = target_project.owner
+      CreateBranchService.new(target_project, target_project_member)
+        .execute('a-brand-new-branch-to-test', 'master')
+
+      visit project_new_merge_request_path(source_project)
+
+      first('.js-target-project').click
+      find('.dropdown-target-project .dropdown-content a', text: target_project.full_path).click
+
+      wait_for_requests
+
+      first('.js-target-branch').click
+
+      within('.dropdown-target-branch .dropdown-content') do
+        expect(page).to have_content('a-brand-new-branch-to-test')
+      end
+    end
   end
 
   context 'creating to the source of a fork' do
-- 
cgit v1.2.1


From e8ca579d88703aeeaa64dbf4ac45f73a60181568 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Fri, 29 Sep 2017 10:04:50 +0200
Subject: Add a project forks spec helper

The helper creates a fork of a project with all provided attributes,
but skipping the creation of the repository on disk.
---
 features/steps/project/fork.rb                     |  4 +-
 features/steps/project/forked_merge_requests.rb    |  5 +-
 features/support/env.rb                            |  2 +-
 spec/controllers/projects/blob_controller_spec.rb  |  7 +--
 .../merge_requests/diffs_controller_spec.rb        | 10 ++--
 .../projects/merge_requests_controller_spec.rb     | 18 +++----
 spec/controllers/projects/notes_controller_spec.rb | 20 ++++----
 spec/controllers/projects_controller_spec.rb       | 20 ++++----
 spec/features/dashboard/merge_requests_spec.rb     |  3 +-
 .../merge_requests/create_new_mr_from_fork_spec.rb | 18 +++++--
 .../merge_requests/created_from_fork_spec.rb       | 17 +++----
 spec/features/merge_requests/diffs_spec.rb         |  4 +-
 spec/features/merge_requests/form_spec.rb          | 12 +++--
 spec/features/projects/issuable_templates_spec.rb  |  8 +--
 .../projects/user_creates_directory_spec.rb        |  2 +-
 spec/features/projects/user_creates_files_spec.rb  |  2 +-
 spec/features/projects/user_deletes_files_spec.rb  |  2 +-
 spec/features/projects/user_replaces_files_spec.rb |  2 +-
 spec/features/projects/user_uploads_files_spec.rb  | 11 ++--
 spec/features/projects_spec.rb                     |  7 +--
 spec/finders/merge_requests_finder_spec.rb         | 12 +++--
 spec/helpers/merge_requests_helper_spec.rb         |  7 +--
 spec/lib/gitlab/import_export/fork_spec.rb         |  6 ++-
 .../import_export/merge_request_parser_spec.rb     |  7 +--
 spec/lib/gitlab/search_results_spec.rb             |  4 +-
 ...dd_head_pipeline_for_each_merge_request_spec.rb |  5 +-
 spec/models/forked_project_link_spec.rb            | 12 +----
 spec/models/merge_request_spec.rb                  | 43 ++++++++--------
 spec/models/project_spec.rb                        | 18 +++----
 spec/models/user_spec.rb                           |  3 +-
 spec/requests/api/merge_requests_spec.rb           | 30 +++++------
 spec/requests/api/projects_spec.rb                 |  5 +-
 spec/requests/api/v3/merge_requests_spec.rb        | 30 +++++------
 spec/requests/lfs_http_spec.rb                     |  6 +--
 spec/serializers/build_details_entity_spec.rb      | 10 ++--
 spec/services/ci/create_pipeline_service_spec.rb   |  8 ++-
 .../delete_merged_branches_service_spec.rb         |  6 ++-
 .../conflicts/resolve_service_spec.rb              | 20 ++++----
 .../merge_requests/get_urls_service_spec.rb        |  4 +-
 .../merge_requests/refresh_service_spec.rb         |  8 +--
 spec/services/projects/fork_service_spec.rb        | 12 ++---
 spec/services/projects/update_service_spec.rb      | 10 ++--
 spec/support/project_forks_helper.rb               | 58 ++++++++++++++++++++++
 .../merge_requests/_commits.html.haml_spec.rb      |  5 +-
 .../projects/merge_requests/edit.html.haml_spec.rb |  9 ++--
 .../projects/merge_requests/show.html.haml_spec.rb | 11 ++--
 .../namespaceless_project_destroy_worker_spec.rb   | 10 ++--
 47 files changed, 308 insertions(+), 225 deletions(-)
 create mode 100644 spec/support/project_forks_helper.rb

diff --git a/features/steps/project/fork.rb b/features/steps/project/fork.rb
index 3490bbd968c..60707f26aee 100644
--- a/features/steps/project/fork.rb
+++ b/features/steps/project/fork.rb
@@ -58,13 +58,13 @@ class Spinach::Features::ProjectFork < Spinach::FeatureSteps
 
   step 'I should see my fork on the list' do
     page.within('.js-projects-list-holder') do
-      project = @user.fork_of(@project)
+      project = @user.fork_of(@project.reload)
       expect(page).to have_content("#{project.namespace.human_name} / #{project.name}")
     end
   end
 
   step 'I make forked repo invalid' do
-    project = @user.fork_of(@project)
+    project = @user.fork_of(@project.reload)
     project.path = 'test-crappy-path'
     project.save!
   end
diff --git a/features/steps/project/forked_merge_requests.rb b/features/steps/project/forked_merge_requests.rb
index 420ac8a695a..6781a906a94 100644
--- a/features/steps/project/forked_merge_requests.rb
+++ b/features/steps/project/forked_merge_requests.rb
@@ -5,6 +5,7 @@ class Spinach::Features::ProjectForkedMergeRequests < Spinach::FeatureSteps
   include SharedPaths
   include Select2Helper
   include WaitForRequests
+  include ProjectForksHelper
 
   step 'I am a member of project "Shop"' do
     @project = ::Project.find_by(name: "Shop")
@@ -13,7 +14,9 @@ class Spinach::Features::ProjectForkedMergeRequests < Spinach::FeatureSteps
   end
 
   step 'I have a project forked off of "Shop" called "Forked Shop"' do
-    @forked_project = Projects::ForkService.new(@project, @user).execute
+    @forked_project = fork_project(@project, @user,
+                                   namespace: @user.namespace,
+                                   repository: true)
   end
 
   step 'I click link "New Merge Request"' do
diff --git a/features/support/env.rb b/features/support/env.rb
index 608d988755c..5962745d501 100644
--- a/features/support/env.rb
+++ b/features/support/env.rb
@@ -10,7 +10,7 @@ if ENV['CI']
   Knapsack::Adapters::SpinachAdapter.bind
 end
 
-%w(select2_helper test_env repo_helpers wait_for_requests sidekiq).each do |f|
+%w(select2_helper test_env repo_helpers wait_for_requests sidekiq project_forks_helper).each do |f|
   require Rails.root.join('spec', 'support', f)
 end
 
diff --git a/spec/controllers/projects/blob_controller_spec.rb b/spec/controllers/projects/blob_controller_spec.rb
index 64b9af7b845..fb76b7fdf38 100644
--- a/spec/controllers/projects/blob_controller_spec.rb
+++ b/spec/controllers/projects/blob_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'rails_helper'
 
 describe Projects::BlobController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :public, :repository) }
 
   describe "GET show" do
@@ -226,9 +228,8 @@ describe Projects::BlobController do
     end
 
     context 'when user has forked project' do
-      let(:forked_project_link) { create(:forked_project_link, forked_from_project: project) }
-      let!(:forked_project) { forked_project_link.forked_to_project }
-      let(:guest) { forked_project.owner }
+      let!(:forked_project) { fork_project(project, guest, namespace: guest.namespace, repository: true) }
+      let(:guest) { create(:user) }
 
       before do
         sign_in(guest)
diff --git a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
index fad2c8f3ab7..7260350d5fb 100644
--- a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::MergeRequests::DiffsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :repository) }
   let(:user)    { project.owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
@@ -37,12 +39,12 @@ describe Projects::MergeRequests::DiffsController do
         render_views
 
         let(:project) { create(:project, :repository) }
-        let(:fork_project) { create(:forked_project_with_submodules) }
-        let(:merge_request) { create(:merge_request_with_diffs, source_project: fork_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
+        let(:forked_project) { fork_project_with_submodules(project) }
+        let(:merge_request) { create(:merge_request_with_diffs, source_project: forked_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
 
         before do
-          fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-          fork_project.save
+          project.add_developer(user)
+
           merge_request.reload
           go
         end
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index e46d1995498..707e7c32283 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::MergeRequestsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :repository) }
   let(:user)    { project.owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
@@ -204,14 +206,11 @@ describe Projects::MergeRequestsController do
 
     context 'there is no source project' do
       let(:project)       { create(:project, :repository) }
-      let(:fork_project)  { create(:forked_project_with_submodules) }
-      let(:merge_request) { create(:merge_request, source_project: fork_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
+      let(:forked_project)  { fork_project_with_submodules(project) }
+      let!(:merge_request) { create(:merge_request, source_project: forked_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
 
       before do
-        fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-        fork_project.save
-        merge_request.reload
-        fork_project.destroy
+        forked_project.destroy
       end
 
       it 'closes MR without errors' do
@@ -599,21 +598,16 @@ describe Projects::MergeRequestsController do
 
   describe 'GET ci_environments_status' do
     context 'the environment is from a forked project' do
-      let!(:forked)       { create(:project, :repository) }
+      let!(:forked)       { fork_project(project, user, repository: true) }
       let!(:environment)  { create(:environment, project: forked) }
       let!(:deployment)   { create(:deployment, environment: environment, sha: forked.commit.id, ref: 'master') }
       let(:admin)         { create(:admin) }
 
       let(:merge_request) do
-        create(:forked_project_link, forked_to_project: forked,
-                                     forked_from_project: project)
-
         create(:merge_request, source_project: forked, target_project: project)
       end
 
       before do
-        forked.team << [user, :master]
-
         get :ci_environments_status,
           namespace_id: merge_request.project.namespace.to_param,
           project_id: merge_request.project,
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index e3114e5c06e..135fd6449ff 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::NotesController do
+  include ProjectForksHelper
+
   let(:user)    { create(:user) }
   let(:project) { create(:project) }
   let(:issue)   { create(:issue, project: project) }
@@ -210,18 +212,16 @@ describe Projects::NotesController do
     context 'when creating a commit comment from an MR fork' do
       let(:project) { create(:project, :repository) }
 
-      let(:fork_project) do
-        create(:project, :repository).tap do |fork|
-          create(:forked_project_link, forked_to_project: fork, forked_from_project: project)
-        end
+      let(:forked_project) do
+        fork_project(project, nil, repository: true)
       end
 
       let(:merge_request) do
-        create(:merge_request, source_project: fork_project, target_project: project, source_branch: 'feature', target_branch: 'master')
+        create(:merge_request, source_project: forked_project, target_project: project, source_branch: 'feature', target_branch: 'master')
       end
 
       let(:existing_comment) do
-        create(:note_on_commit, note: 'a note', project: fork_project, commit_id: merge_request.commit_shas.first)
+        create(:note_on_commit, note: 'a note', project: forked_project, commit_id: merge_request.commit_shas.first)
       end
 
       def post_create(extra_params = {})
@@ -231,7 +231,7 @@ describe Projects::NotesController do
                project_id: project,
                target_type: 'merge_request',
                target_id: merge_request.id,
-               note_project_id: fork_project.id,
+               note_project_id: forked_project.id,
                in_reply_to_discussion_id: existing_comment.discussion_id
              }.merge(extra_params)
       end
@@ -253,16 +253,16 @@ describe Projects::NotesController do
       end
 
       context 'when the user has access to the fork' do
-        let(:discussion) { fork_project.notes.find_discussion(existing_comment.discussion_id) }
+        let(:discussion) { forked_project.notes.find_discussion(existing_comment.discussion_id) }
 
         before do
-          fork_project.add_developer(user)
+          forked_project.add_developer(user)
 
           existing_comment
         end
 
         it 'creates the note' do
-          expect { post_create }.to change { fork_project.notes.count }.by(1)
+          expect { post_create }.to change { forked_project.notes.count }.by(1)
         end
       end
     end
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 491f35d0fb6..d7148e888ab 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -1,6 +1,8 @@
 require('spec_helper')
 
 describe ProjectsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project) }
   let(:public_project) { create(:project, :public) }
   let(:user) { create(:user) }
@@ -377,10 +379,10 @@ describe ProjectsController do
 
     context "when the project is forked" do
       let(:project)      { create(:project, :repository) }
-      let(:fork_project) { create(:project, :repository, forked_from_project: project) }
+      let(:forked_project) { fork_project(project, nil, repository: true) }
       let(:merge_request) do
         create(:merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -388,7 +390,7 @@ describe ProjectsController do
         project.merge_requests << merge_request
         sign_in(admin)
 
-        delete :destroy, namespace_id: fork_project.namespace, id: fork_project
+        delete :destroy, namespace_id: forked_project.namespace, id: forked_project
 
         expect(merge_request.reload.state).to eq('closed')
       end
@@ -455,18 +457,14 @@ describe ProjectsController do
       end
 
       context 'with forked project' do
-        let(:project_fork) { create(:project, :repository, namespace: user.namespace) }
-
-        before do
-          create(:forked_project_link, forked_to_project: project_fork)
-        end
+        let(:forked_project) { fork_project(create(:project, :public), user) }
 
         it 'removes fork from project' do
           delete(:remove_fork,
-              namespace_id: project_fork.namespace.to_param,
-              id: project_fork.to_param, format: :js)
+              namespace_id: forked_project.namespace.to_param,
+              id: forked_project.to_param, format: :js)
 
-          expect(project_fork.forked?).to be_falsey
+          expect(forked_project.reload.forked?).to be_falsey
           expect(flash[:notice]).to eq('The fork relationship has been removed.')
           expect(response).to render_template(:remove_fork)
         end
diff --git a/spec/features/dashboard/merge_requests_spec.rb b/spec/features/dashboard/merge_requests_spec.rb
index 8204828b5b9..d26428ec286 100644
--- a/spec/features/dashboard/merge_requests_spec.rb
+++ b/spec/features/dashboard/merge_requests_spec.rb
@@ -3,12 +3,13 @@ require 'spec_helper'
 feature 'Dashboard Merge Requests' do
   include FilterItemSelectHelper
   include SortingHelper
+  include ProjectForksHelper
 
   let(:current_user) { create :user }
   let(:project) { create(:project) }
 
   let(:public_project) { create(:project, :public, :repository) }
-  let(:forked_project) { Projects::ForkService.new(public_project, current_user).execute }
+  let(:forked_project) { fork_project(public_project, current_user, repository: true) }
 
   before do
     project.add_master(current_user)
diff --git a/spec/features/merge_requests/create_new_mr_from_fork_spec.rb b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
index e6f827174e2..93c40ff6443 100644
--- a/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
+++ b/spec/features/merge_requests/create_new_mr_from_fork_spec.rb
@@ -1,9 +1,15 @@
 require 'spec_helper'
 
 feature 'Creating a merge request from a fork', :js do
+  include ProjectForksHelper
+
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
-  let!(:source_project) { ::Projects::ForkService.new(project, user).execute }
+  let!(:source_project) do
+    fork_project(project, user,
+                 repository: true,
+                 namespace: user.namespace)
+  end
 
   before do
     source_project.add_master(user)
@@ -49,7 +55,6 @@ feature 'Creating a merge request from a fork', :js do
       target_project_member = target_project.owner
       CreateBranchService.new(target_project, target_project_member)
         .execute('a-brand-new-branch-to-test', 'master')
-
       visit project_new_merge_request_path(source_project)
 
       first('.js-target-project').click
@@ -66,13 +71,18 @@ feature 'Creating a merge request from a fork', :js do
   end
 
   context 'creating to the source of a fork' do
-    let(:target_project) { project }
+    let!(:target_project) { project }
 
     it_behaves_like('create merge request to other project')
   end
 
   context 'creating to a sibling of a fork' do
-    let!(:target_project) { ::Projects::ForkService.new(project, create(:user)).execute }
+    let!(:target_project) do
+      other_user = create(:user)
+      fork_project(project, other_user,
+                   repository: true,
+                   namespace: other_user.namespace)
+    end
 
     it_behaves_like('create merge request to other project')
   end
diff --git a/spec/features/merge_requests/created_from_fork_spec.rb b/spec/features/merge_requests/created_from_fork_spec.rb
index 09541873f71..f9bc3ee6c58 100644
--- a/spec/features/merge_requests/created_from_fork_spec.rb
+++ b/spec/features/merge_requests/created_from_fork_spec.rb
@@ -1,21 +1,20 @@
 require 'spec_helper'
 
 feature 'Merge request created from fork' do
+  include ProjectForksHelper
+
   given(:user) { create(:user) }
   given(:project) { create(:project, :public, :repository) }
-  given(:fork_project) { create(:project, :public, :repository) }
+  given(:forked_project) { fork_project(project, user, repository: true) }
 
   given!(:merge_request) do
-    create(:forked_project_link, forked_to_project: fork_project,
-                                 forked_from_project: project)
-
-    create(:merge_request_with_diffs, source_project: fork_project,
+    create(:merge_request_with_diffs, source_project: forked_project,
                                       target_project: project,
                                       description: 'Test merge request')
   end
 
   background do
-    fork_project.team << [user, :master]
+    forked_project.team << [user, :master]
     sign_in user
   end
 
@@ -31,7 +30,7 @@ feature 'Merge request created from fork' do
 
     background do
       create(:note_on_commit, note: comment,
-                              project: fork_project,
+                              project: forked_project,
                               commit_id: merge_request.commit_shas.first)
     end
 
@@ -55,7 +54,7 @@ feature 'Merge request created from fork' do
   context 'source project is deleted' do
     background do
       MergeRequests::MergeService.new(project, user).execute(merge_request)
-      fork_project.destroy!
+      forked_project.destroy!
     end
 
     scenario 'user can access merge request', js: true do
@@ -69,7 +68,7 @@ feature 'Merge request created from fork' do
   context 'pipeline present in source project' do
     given(:pipeline) do
       create(:ci_pipeline,
-             project: fork_project,
+             project: forked_project,
              sha: merge_request.diff_head_sha,
              ref: merge_request.source_branch)
     end
diff --git a/spec/features/merge_requests/diffs_spec.rb b/spec/features/merge_requests/diffs_spec.rb
index f4ba660ca39..ee9bb50a881 100644
--- a/spec/features/merge_requests/diffs_spec.rb
+++ b/spec/features/merge_requests/diffs_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 feature 'Diffs URL', js: true do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :public, :repository) }
   let(:merge_request) { create(:merge_request, source_project: project) }
 
@@ -68,7 +70,7 @@ feature 'Diffs URL', js: true do
   context 'when editing file' do
     let(:author_user) { create(:user) }
     let(:user) { create(:user) }
-    let(:forked_project) { Projects::ForkService.new(project, author_user).execute }
+    let(:forked_project) { fork_project(project, author_user, repository: true) }
     let(:merge_request) { create(:merge_request_with_diffs, source_project: forked_project, target_project: project, author: author_user) }
     let(:changelog_id) { Digest::SHA1.hexdigest("CHANGELOG") }
 
diff --git a/spec/features/merge_requests/form_spec.rb b/spec/features/merge_requests/form_spec.rb
index de98b147d04..758fc9b139d 100644
--- a/spec/features/merge_requests/form_spec.rb
+++ b/spec/features/merge_requests/form_spec.rb
@@ -1,8 +1,10 @@
 require 'rails_helper'
 
 describe 'New/edit merge request', :js do
+  include ProjectForksHelper
+
   let!(:project)     { create(:project, :public, :repository) }
-  let(:fork_project) { create(:project, :repository, forked_from_project: project) }
+  let(:forked_project) { fork_project(project, nil, repository: true) }
   let!(:user)        { create(:user) }
   let!(:user2)       { create(:user) }
   let!(:milestone)   { create(:milestone, project: project) }
@@ -170,16 +172,16 @@ describe 'New/edit merge request', :js do
 
   context 'forked project' do
     before do
-      fork_project.team << [user, :master]
+      forked_project.team << [user, :master]
       sign_in(user)
     end
 
     context 'new merge request' do
       before do
         visit project_new_merge_request_path(
-          fork_project,
+          forked_project,
           merge_request: {
-            source_project_id: fork_project.id,
+            source_project_id: forked_project.id,
             target_project_id: project.id,
             source_branch: 'fix',
             target_branch: 'master'
@@ -238,7 +240,7 @@ describe 'New/edit merge request', :js do
     context 'edit merge request' do
       before do
         merge_request = create(:merge_request,
-                                 source_project: fork_project,
+                                 source_project: forked_project,
                                  target_project: project,
                                  source_branch: 'fix',
                                  target_branch: 'master'
diff --git a/spec/features/projects/issuable_templates_spec.rb b/spec/features/projects/issuable_templates_spec.rb
index 1f9b52dd998..c9b8ef4e37b 100644
--- a/spec/features/projects/issuable_templates_spec.rb
+++ b/spec/features/projects/issuable_templates_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 feature 'issuable templates', js: true do
+  include ProjectForksHelper
+
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
   let(:issue_form_location) { '#content-body .issuable-details .detail-page-description' }
@@ -116,15 +118,13 @@ feature 'issuable templates', js: true do
   context 'user creates a merge request from a forked project using templates' do
     let(:template_content) { 'this is a test "feature-proposal" template' }
     let(:fork_user) { create(:user) }
-    let(:fork_project) { create(:project, :public, :repository) }
-    let(:merge_request) { create(:merge_request, :with_diffs, source_project: fork_project, target_project: project) }
+    let(:forked_project) { fork_project(project, fork_user) }
+    let(:merge_request) { create(:merge_request, :with_diffs, source_project: forked_project, target_project: project) }
 
     background do
       sign_out(:user)
 
       project.team << [fork_user, :developer]
-      fork_project.team << [fork_user, :master]
-      create(:forked_project_link, forked_to_project: fork_project, forked_from_project: project)
 
       sign_in(fork_user)
 
diff --git a/spec/features/projects/user_creates_directory_spec.rb b/spec/features/projects/user_creates_directory_spec.rb
index 1ba5d83eadf..e8f2e4813c5 100644
--- a/spec/features/projects/user_creates_directory_spec.rb
+++ b/spec/features/projects/user_creates_directory_spec.rb
@@ -79,7 +79,7 @@ feature 'User creates a directory', js: true do
       fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Create directory')
 
-      fork = user.fork_of(project2)
+      fork = user.fork_of(project2.reload)
 
       expect(current_path).to eq(project_new_merge_request_path(fork))
     end
diff --git a/spec/features/projects/user_creates_files_spec.rb b/spec/features/projects/user_creates_files_spec.rb
index 3d335687510..51d918bc85d 100644
--- a/spec/features/projects/user_creates_files_spec.rb
+++ b/spec/features/projects/user_creates_files_spec.rb
@@ -142,7 +142,7 @@ describe 'User creates files' do
         fill_in(:commit_message, with: 'New commit message', visible: true)
         click_button('Commit changes')
 
-        fork = user.fork_of(project2)
+        fork = user.fork_of(project2.reload)
 
         expect(current_path).to eq(project_new_merge_request_path(fork))
         expect(page).to have_content('New commit message')
diff --git a/spec/features/projects/user_deletes_files_spec.rb b/spec/features/projects/user_deletes_files_spec.rb
index 95cd316be0e..7f48a69d9b7 100644
--- a/spec/features/projects/user_deletes_files_spec.rb
+++ b/spec/features/projects/user_deletes_files_spec.rb
@@ -59,7 +59,7 @@ describe 'User deletes files' do
       fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Delete file')
 
-      fork = user.fork_of(project2)
+      fork = user.fork_of(project2.reload)
 
       expect(current_path).to eq(project_new_merge_request_path(fork))
       expect(page).to have_content('New commit message')
diff --git a/spec/features/projects/user_replaces_files_spec.rb b/spec/features/projects/user_replaces_files_spec.rb
index e284fdefd4f..a9628198d5b 100644
--- a/spec/features/projects/user_replaces_files_spec.rb
+++ b/spec/features/projects/user_replaces_files_spec.rb
@@ -74,7 +74,7 @@ describe 'User replaces files' do
 
       expect(page).to have_content('Replacement file commit message')
 
-      fork = user.fork_of(project2)
+      fork = user.fork_of(project2.reload)
 
       expect(current_path).to eq(project_new_merge_request_path(fork))
 
diff --git a/spec/features/projects/user_uploads_files_spec.rb b/spec/features/projects/user_uploads_files_spec.rb
index 98871317ca3..8014c299980 100644
--- a/spec/features/projects/user_uploads_files_spec.rb
+++ b/spec/features/projects/user_uploads_files_spec.rb
@@ -39,6 +39,9 @@ describe 'User uploads files' do
       expect(current_path).to eq(project_new_merge_request_path(project))
 
       click_link('Changes')
+      find("a[data-action='diffs']", text: 'Changes').click
+
+      wait_for_requests
 
       expect(page).to have_content('Lorem ipsum dolor sit amet')
       expect(page).to have_content('Sed ut perspiciatis unde omnis')
@@ -51,7 +54,7 @@ describe 'User uploads files' do
       visit(project2_tree_path_root_ref)
     end
 
-    it 'uploads and commit a new fileto a forked project', js: true do
+    it 'uploads and commit a new file to a forked project', js: true do
       find('.add-to-tree').click
       click_link('Upload file')
 
@@ -69,11 +72,13 @@ describe 'User uploads files' do
 
       expect(page).to have_content('New commit message')
 
-      fork = user.fork_of(project2)
+      fork = user.fork_of(project2.reload)
 
       expect(current_path).to eq(project_new_merge_request_path(fork))
 
-      click_link('Changes')
+      find("a[data-action='diffs']", text: 'Changes').click
+
+      wait_for_requests
 
       expect(page).to have_content('Lorem ipsum dolor sit amet')
       expect(page).to have_content('Sed ut perspiciatis unde omnis')
diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb
index 81f7ab80a04..b957575a244 100644
--- a/spec/features/projects_spec.rb
+++ b/spec/features/projects_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 feature 'Project' do
+  include ProjectForksHelper
+
   describe 'creating from template' do
     let(:user)    { create(:user) }
     let(:template) { Gitlab::ProjectTemplate.find(:rails) }
@@ -57,11 +59,10 @@ feature 'Project' do
 
   describe 'remove forked relationship', js: true do
     let(:user)    { create(:user) }
-    let(:project) { create(:project, namespace: user.namespace) }
+    let(:project) { fork_project(create(:project, :public), user, namespace_id: user.namespace) }
 
     before do
       sign_in user
-      create(:forked_project_link, forked_to_project: project)
       visit edit_project_path(project)
     end
 
@@ -71,7 +72,7 @@ feature 'Project' do
       remove_with_confirm('Remove fork relationship', project.path)
 
       expect(page).to have_content 'The fork relationship has been removed.'
-      expect(project.forked?).to be_falsey
+      expect(project.reload.forked?).to be_falsey
       expect(page).not_to have_content 'Remove fork relationship'
     end
   end
diff --git a/spec/finders/merge_requests_finder_spec.rb b/spec/finders/merge_requests_finder_spec.rb
index 95f445e7905..883bdf3746a 100644
--- a/spec/finders/merge_requests_finder_spec.rb
+++ b/spec/finders/merge_requests_finder_spec.rb
@@ -1,12 +1,18 @@
 require 'spec_helper'
 
 describe MergeRequestsFinder do
+  include ProjectForksHelper
+
   let(:user)  { create :user }
   let(:user2) { create :user }
 
-  let(:project1) { create(:project) }
-  let(:project2) { create(:project, forked_from_project: project1) }
-  let(:project3) { create(:project, :archived, forked_from_project: project1) }
+  let(:project1) { create(:project, :public) }
+  let(:project2) { fork_project(project1, user) }
+  let(:project3) do
+    p = fork_project(project1, user)
+    p.update!(archived: true)
+    p
+  end
 
   let!(:merge_request1) { create(:merge_request, :simple, author: user, source_project: project2, target_project: project1) }
   let!(:merge_request2) { create(:merge_request, :simple, author: user, source_project: project2, target_project: project1, state: 'closed') }
diff --git a/spec/helpers/merge_requests_helper_spec.rb b/spec/helpers/merge_requests_helper_spec.rb
index 7d1c17909bf..fd7900c32f4 100644
--- a/spec/helpers/merge_requests_helper_spec.rb
+++ b/spec/helpers/merge_requests_helper_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe MergeRequestsHelper do
+  include ProjectForksHelper
   describe 'ci_build_details_path' do
     let(:project) { create(:project) }
     let(:merge_request) { MergeRequest.new }
@@ -31,10 +32,10 @@ describe MergeRequestsHelper do
 
     describe 'within different projects' do
       let(:project) { create(:project) }
-      let(:fork_project) { create(:project, forked_from_project: project) }
-      let(:merge_request) { create(:merge_request, source_project: fork_project, target_project: project) }
+      let(:forked_project) { fork_project(project) }
+      let(:merge_request) { create(:merge_request, source_project: forked_project, target_project: project) }
       subject { format_mr_branch_names(merge_request) }
-      let(:source_title) { "#{fork_project.full_path}:#{merge_request.source_branch}" }
+      let(:source_title) { "#{forked_project.full_path}:#{merge_request.source_branch}" }
       let(:target_title) { "#{project.full_path}:#{merge_request.target_branch}" }
 
       it { is_expected.to eq([source_title, target_title]) }
diff --git a/spec/lib/gitlab/import_export/fork_spec.rb b/spec/lib/gitlab/import_export/fork_spec.rb
index c7fbc2bc92f..dd0ce0dae41 100644
--- a/spec/lib/gitlab/import_export/fork_spec.rb
+++ b/spec/lib/gitlab/import_export/fork_spec.rb
@@ -1,13 +1,15 @@
 require 'spec_helper'
 
 describe 'forked project import' do
+  include ProjectForksHelper
+
   let(:user) { create(:user) }
   let!(:project_with_repo) { create(:project, :repository, name: 'test-repo-restorer', path: 'test-repo-restorer') }
   let!(:project) { create(:project, name: 'test-repo-restorer-no-repo', path: 'test-repo-restorer-no-repo') }
   let(:export_path) { "#{Dir.tmpdir}/project_tree_saver_spec" }
   let(:shared) { Gitlab::ImportExport::Shared.new(relative_path: project.full_path) }
   let(:forked_from_project) { create(:project, :repository) }
-  let(:fork_link) { create(:forked_project_link, forked_from_project: project_with_repo) }
+  let(:forked_project) { fork_project(project_with_repo, nil, repository: true) }
   let(:repo_saver) { Gitlab::ImportExport::RepoSaver.new(project: project_with_repo, shared: shared) }
   let(:bundle_path) { File.join(shared.export_path, Gitlab::ImportExport.project_bundle_filename) }
 
@@ -16,7 +18,7 @@ describe 'forked project import' do
   end
 
   let!(:merge_request) do
-    create(:merge_request, source_project: fork_link.forked_to_project, target_project: project_with_repo)
+    create(:merge_request, source_project: forked_project, target_project: project_with_repo)
   end
 
   let(:saver) do
diff --git a/spec/lib/gitlab/import_export/merge_request_parser_spec.rb b/spec/lib/gitlab/import_export/merge_request_parser_spec.rb
index 4d87f27ce05..473ba40fae7 100644
--- a/spec/lib/gitlab/import_export/merge_request_parser_spec.rb
+++ b/spec/lib/gitlab/import_export/merge_request_parser_spec.rb
@@ -1,13 +1,14 @@
 require 'spec_helper'
 
 describe Gitlab::ImportExport::MergeRequestParser do
+  include ProjectForksHelper
+
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository, name: 'test-repo-restorer', path: 'test-repo-restorer') }
-  let(:forked_from_project) { create(:project, :repository) }
-  let(:fork_link) { create(:forked_project_link, forked_from_project: project) }
+  let(:forked_project) { fork_project(project) }
 
   let!(:merge_request) do
-    create(:merge_request, source_project: fork_link.forked_to_project, target_project: project)
+    create(:merge_request, source_project: forked_project, target_project: project)
   end
 
   let(:parsed_merge_request) do
diff --git a/spec/lib/gitlab/search_results_spec.rb b/spec/lib/gitlab/search_results_spec.rb
index 4c5efbde69a..e44a7c23452 100644
--- a/spec/lib/gitlab/search_results_spec.rb
+++ b/spec/lib/gitlab/search_results_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Gitlab::SearchResults do
+  include ProjectForksHelper
+
   let(:user) { create(:user) }
   let!(:project) { create(:project, name: 'foo') }
   let!(:issue) { create(:issue, project: project, title: 'foo') }
@@ -42,7 +44,7 @@ describe Gitlab::SearchResults do
     end
 
     it 'includes merge requests from source and target projects' do
-      forked_project = create(:project, forked_from_project: project)
+      forked_project = fork_project(project, user)
       merge_request_2 = create(:merge_request, target_project: project, source_project: forked_project, title: 'foo')
 
       results = described_class.new(user, Project.where(id: forked_project.id), 'foo')
diff --git a/spec/migrations/add_head_pipeline_for_each_merge_request_spec.rb b/spec/migrations/add_head_pipeline_for_each_merge_request_spec.rb
index 862907c5d01..84c2e9f7e52 100644
--- a/spec/migrations/add_head_pipeline_for_each_merge_request_spec.rb
+++ b/spec/migrations/add_head_pipeline_for_each_merge_request_spec.rb
@@ -2,11 +2,12 @@ require 'spec_helper'
 require Rails.root.join('db', 'post_migrate', '20170508170547_add_head_pipeline_for_each_merge_request.rb')
 
 describe AddHeadPipelineForEachMergeRequest, :truncate do
+  include ProjectForksHelper
+
   let(:migration) { described_class.new }
 
   let!(:project) { create(:project) }
-  let!(:forked_project_link) { create(:forked_project_link, forked_from_project: project) }
-  let!(:other_project) { forked_project_link.forked_to_project }
+  let!(:other_project) { fork_project(project) }
 
   let!(:pipeline_1) { create(:ci_pipeline, project: project, ref: "branch_1") }
   let!(:pipeline_2) { create(:ci_pipeline, project: other_project, ref: "branch_1") }
diff --git a/spec/models/forked_project_link_spec.rb b/spec/models/forked_project_link_spec.rb
index 7dbeb4d2e74..32e33e8f42f 100644
--- a/spec/models/forked_project_link_spec.rb
+++ b/spec/models/forked_project_link_spec.rb
@@ -1,10 +1,11 @@
 require 'spec_helper'
 
 describe ForkedProjectLink, "add link on fork" do
+  include ProjectForksHelper
+
   let(:project_from) { create(:project, :repository) }
   let(:project_to) { fork_project(project_from, user) }
   let(:user) { create(:user) }
-  let(:namespace) { user.namespace }
 
   before do
     project_from.add_reporter(user)
@@ -64,13 +65,4 @@ describe ForkedProjectLink, "add link on fork" do
       expect(ForkedProjectLink.exists?(id: forked_project_link.id)).to eq(false)
     end
   end
-
-  def fork_project(from_project, user)
-    service = Projects::ForkService.new(from_project, user)
-    shell = double('gitlab_shell', fork_repository: true)
-
-    allow(service).to receive(:gitlab_shell).and_return(shell)
-
-    service.execute
-  end
 end
diff --git a/spec/models/merge_request_spec.rb b/spec/models/merge_request_spec.rb
index 5f3e3c05d78..950af653c80 100644
--- a/spec/models/merge_request_spec.rb
+++ b/spec/models/merge_request_spec.rb
@@ -2,6 +2,7 @@ require 'spec_helper'
 
 describe MergeRequest do
   include RepoHelpers
+  include ProjectForksHelper
 
   subject { create(:merge_request) }
 
@@ -52,8 +53,8 @@ describe MergeRequest do
 
     context 'for forks' do
       let(:project) { create(:project) }
-      let(:fork1) { create(:forked_project_link, forked_from_project: project).forked_to_project }
-      let(:fork2) { create(:forked_project_link, forked_from_project: project).forked_to_project }
+      let(:fork1) { fork_project(project) }
+      let(:fork2) { fork_project(project) }
 
       it 'allows merge requests for sibling-forks' do
         subject.source_project = fork1
@@ -685,7 +686,7 @@ describe MergeRequest do
 
   describe '#diverged_commits_count' do
     let(:project)      { create(:project, :repository) }
-    let(:fork_project) { create(:project, :repository, forked_from_project: project) }
+    let(:forked_project) { fork_project(project, nil, repository: true) }
 
     context 'when the target branch does not exist anymore' do
       subject { create(:merge_request, source_project: project, target_project: project) }
@@ -713,7 +714,7 @@ describe MergeRequest do
     end
 
     context 'diverged on fork' do
-      subject(:merge_request_fork_with_divergence) { create(:merge_request, :diverged, source_project: fork_project, target_project: project) }
+      subject(:merge_request_fork_with_divergence) { create(:merge_request, :diverged, source_project: forked_project, target_project: project) }
 
       it 'counts commits that are on target branch but not on source branch' do
         expect(subject.diverged_commits_count).to eq(29)
@@ -721,7 +722,7 @@ describe MergeRequest do
     end
 
     context 'rebased on fork' do
-      subject(:merge_request_rebased) { create(:merge_request, :rebased, source_project: fork_project, target_project: project) }
+      subject(:merge_request_rebased) { create(:merge_request, :rebased, source_project: forked_project, target_project: project) }
 
       it 'counts commits that are on target branch but not on source branch' do
         expect(subject.diverged_commits_count).to eq(0)
@@ -1270,11 +1271,7 @@ describe MergeRequest do
     end
 
     context 'with environments on source project' do
-      let(:source_project) do
-        create(:project, :repository) do |fork_project|
-          fork_project.create_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-        end
-      end
+      let(:source_project) { fork_project(project, nil, repository: true) }
 
       let(:merge_request) do
         create(:merge_request,
@@ -1438,14 +1435,14 @@ describe MergeRequest do
 
   describe "#source_project_missing?" do
     let(:project)      { create(:project) }
-    let(:fork_project) { create(:forked_project_link, forked_from_project: project).forked_to_project }
+    let(:forked_project) { fork_project(project) }
     let(:user)         { create(:user) }
-    let(:unlink_project) { Projects::UnlinkForkService.new(fork_project, user) }
+    let(:unlink_project) { Projects::UnlinkForkService.new(forked_project, user) }
 
     context "when the fork exists" do
       let(:merge_request) do
         create(:merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -1461,7 +1458,7 @@ describe MergeRequest do
     context "when the fork does not exist" do
       let!(:merge_request) do
         create(:merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -1484,14 +1481,14 @@ describe MergeRequest do
 
   describe "#closed_without_fork?" do
     let(:project)      { create(:project) }
-    let(:fork_project) { create(:project, forked_from_project: project) }
+    let(:forked_project) { fork_project(project) }
     let(:user)         { create(:user) }
-    let(:unlink_project) { Projects::UnlinkForkService.new(fork_project, user) }
+    let(:unlink_project) { Projects::UnlinkForkService.new(forked_project, user) }
 
     context "when the merge request is closed" do
       let(:closed_merge_request) do
         create(:closed_merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -1510,7 +1507,7 @@ describe MergeRequest do
     context "when the merge request is open" do
       let(:open_merge_request) do
         create(:merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -1529,24 +1526,24 @@ describe MergeRequest do
       end
 
       context 'forked project' do
-        let(:project)      { create(:project) }
+        let(:project)      { create(:project, :public) }
         let(:user)         { create(:user) }
-        let(:fork_project) { create(:project, forked_from_project: project, namespace: user.namespace) }
+        let(:forked_project) { fork_project(project, user) }
 
         let!(:merge_request) do
           create(:closed_merge_request,
-            source_project: fork_project,
+            source_project: forked_project,
             target_project: project)
         end
 
         it 'returns false if unforked' do
-          Projects::UnlinkForkService.new(fork_project, user).execute
+          Projects::UnlinkForkService.new(forked_project, user).execute
 
           expect(merge_request.reload.reopenable?).to be_falsey
         end
 
         it 'returns false if the source project is deleted' do
-          Projects::DestroyService.new(fork_project, user).execute
+          Projects::DestroyService.new(forked_project, user).execute
 
           expect(merge_request.reload.reopenable?).to be_falsey
         end
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 40b64cad475..f7155369666 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -1819,40 +1819,34 @@ describe Project do
   end
 
   context 'forks' do
+    include ProjectForksHelper
+
     let(:project) { create(:project, :public) }
     let!(:forked_project) { fork_project(project) }
 
-    def fork_project(project)
-      Projects::ForkService.new(project, create(:user)).execute
-    end
-
     describe '#fork_network' do
       it 'includes a fork of the project' do
-        expect(project.fork_network).to include(forked_project)
+        expect(project.fork_network.projects).to include(forked_project)
       end
 
       it 'includes a fork of a fork' do
         other_fork = fork_project(forked_project)
 
-        expect(project.fork_network).to include(other_fork)
+        expect(project.fork_network.projects).to include(other_fork)
       end
 
       it 'includes sibling forks' do
         other_fork = fork_project(project)
 
-        expect(forked_project.fork_network).to include(other_fork)
+        expect(forked_project.fork_network.projects).to include(other_fork)
       end
 
       it 'includes the base project' do
-        expect(forked_project.fork_network).to include(project)
+        expect(forked_project.fork_network.projects).to include(project.reload)
       end
     end
 
     describe '#in_fork_network_of?' do
-      it 'is false when the project is not a fork' do
-        expect(project.in_fork_network_of?(double)).to be_falsy
-      end
-
       it 'is true for a real fork' do
         expect(forked_project.in_fork_network_of?(project)).to be_truthy
       end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 995211845ce..52ca068f9a4 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -2,6 +2,7 @@ require 'spec_helper'
 
 describe User do
   include Gitlab::CurrentSettings
+  include ProjectForksHelper
 
   describe 'modules' do
     subject { described_class }
@@ -1431,7 +1432,7 @@ describe User do
   describe "#contributed_projects" do
     subject { create(:user) }
     let!(:project1) { create(:project) }
-    let!(:project2) { create(:project, forked_from_project: project3) }
+    let!(:project2) { fork_project(project3) }
     let!(:project3) { create(:project) }
     let!(:merge_request) { create(:merge_request, source_project: project2, target_project: project3, author: subject) }
     let!(:push_event) { create(:push_event, project: project1, author: subject) }
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 377d1a8f877..5e66e1607ba 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -1,6 +1,8 @@
 require "spec_helper"
 
 describe API::MergeRequests do
+  include ProjectForksHelper
+
   let(:base_time)   { Time.now }
   let(:user)        { create(:user) }
   let(:admin)       { create(:user, :admin) }
@@ -616,17 +618,17 @@ describe API::MergeRequests do
 
     context 'forked projects' do
       let!(:user2) { create(:user) }
-      let!(:fork_project) { create(:project, forked_from_project: project,  namespace: user2.namespace, creator_id: user2.id) }
+      let!(:forked_project) { fork_project(project, user2) }
       let!(:unrelated_project) { create(:project,  namespace: create(:user).namespace, creator_id: user2.id) }
 
       before do
-        fork_project.add_reporter(user2)
+        forked_project.add_reporter(user2)
 
         allow_any_instance_of(MergeRequest).to receive(:write_ref)
       end
 
       it "returns merge_request" do
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
           title: 'Test merge_request', source_branch: "feature_conflict", target_branch: "master",
           author: user2, target_project_id: project.id, description: 'Test description for Test merge_request'
         expect(response).to have_gitlab_http_status(201)
@@ -635,10 +637,10 @@ describe API::MergeRequests do
       end
 
       it "does not return 422 when source_branch equals target_branch" do
-        expect(project.id).not_to eq(fork_project.id)
-        expect(fork_project.forked?).to be_truthy
-        expect(fork_project.forked_from_project).to eq(project)
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        expect(project.id).not_to eq(forked_project.id)
+        expect(forked_project.forked?).to be_truthy
+        expect(forked_project.forked_from_project).to eq(project)
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', source_branch: "master", target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(201)
         expect(json_response['title']).to eq('Test merge_request')
@@ -647,7 +649,7 @@ describe API::MergeRequests do
       it 'returns 422 when target project has disabled merge requests' do
         project.project_feature.update(merge_requests_access_level: 0)
 
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
              title: 'Test',
              target_branch: 'master',
              source_branch: 'markdown',
@@ -658,26 +660,26 @@ describe API::MergeRequests do
       end
 
       it "returns 400 when source_branch is missing" do
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       it "returns 400 when target_branch is missing" do
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       it "returns 400 when title is missing" do
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
         target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       context 'when target_branch is specified' do
         it 'returns 422 if targeting a different fork' do
-          post api("/projects/#{fork_project.id}/merge_requests", user2),
+          post api("/projects/#{forked_project.id}/merge_requests", user2),
                title: 'Test merge_request',
                target_branch: 'master',
                source_branch: 'markdown',
@@ -688,8 +690,8 @@ describe API::MergeRequests do
       end
 
       it "returns 201 when target_branch is specified and for the same project" do
-        post api("/projects/#{fork_project.id}/merge_requests", user2),
-        title: 'Test merge_request', target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: fork_project.id
+        post api("/projects/#{forked_project.id}/merge_requests", user2),
+        title: 'Test merge_request', target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: forked_project.id
         expect(response).to have_gitlab_http_status(201)
       end
     end
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 18f6f7df1fa..5964244f8c5 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -64,9 +64,12 @@ describe API::Projects do
           create(:project, :public)
         end
 
+        # TODO: We're currently querying to detect if a project is a fork
+        # in 2 ways. Lower this back to 8 when `ForkedProjectLink` relation is
+        # removed
         expect do
           get api('/projects', current_user)
-        end.not_to exceed_query_limit(control).with_threshold(8)
+        end.not_to exceed_query_limit(control).with_threshold(9)
       end
     end
 
diff --git a/spec/requests/api/v3/merge_requests_spec.rb b/spec/requests/api/v3/merge_requests_spec.rb
index acd53fbff66..df73c731c96 100644
--- a/spec/requests/api/v3/merge_requests_spec.rb
+++ b/spec/requests/api/v3/merge_requests_spec.rb
@@ -1,6 +1,8 @@
 require "spec_helper"
 
 describe API::MergeRequests do
+  include ProjectForksHelper
+
   let(:base_time)   { Time.now }
   let(:user)        { create(:user) }
   let(:admin)       { create(:user, :admin) }
@@ -312,17 +314,17 @@ describe API::MergeRequests do
 
     context 'forked projects' do
       let!(:user2) { create(:user) }
-      let!(:fork_project) { create(:project, forked_from_project: project,  namespace: user2.namespace, creator_id: user2.id) }
+      let!(:forked_project) { fork_project(project, user2) }
       let!(:unrelated_project) { create(:project,  namespace: create(:user).namespace, creator_id: user2.id) }
 
       before do
-        fork_project.add_reporter(user2)
+        forked_project.add_reporter(user2)
 
         allow_any_instance_of(MergeRequest).to receive(:write_ref)
       end
 
       it "returns merge_request" do
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
           title: 'Test merge_request', source_branch: "feature_conflict", target_branch: "master",
           author: user2, target_project_id: project.id, description: 'Test description for Test merge_request'
         expect(response).to have_gitlab_http_status(201)
@@ -331,10 +333,10 @@ describe API::MergeRequests do
       end
 
       it "does not return 422 when source_branch equals target_branch" do
-        expect(project.id).not_to eq(fork_project.id)
-        expect(fork_project.forked?).to be_truthy
-        expect(fork_project.forked_from_project).to eq(project)
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        expect(project.id).not_to eq(forked_project.id)
+        expect(forked_project.forked?).to be_truthy
+        expect(forked_project.forked_from_project).to eq(project)
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', source_branch: "master", target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(201)
         expect(json_response['title']).to eq('Test merge_request')
@@ -343,7 +345,7 @@ describe API::MergeRequests do
       it "returns 422 when target project has disabled merge requests" do
         project.project_feature.update(merge_requests_access_level: 0)
 
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
              title: 'Test',
              target_branch: "master",
              source_branch: 'markdown',
@@ -354,26 +356,26 @@ describe API::MergeRequests do
       end
 
       it "returns 400 when source_branch is missing" do
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       it "returns 400 when target_branch is missing" do
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
         title: 'Test merge_request', target_branch: "master", author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       it "returns 400 when title is missing" do
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
         target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: project.id
         expect(response).to have_gitlab_http_status(400)
       end
 
       context 'when target_branch is specified' do
         it 'returns 422 if targeting a different fork' do
-          post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
+          post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
                title: 'Test merge_request',
                target_branch: 'master',
                source_branch: 'markdown',
@@ -384,8 +386,8 @@ describe API::MergeRequests do
       end
 
       it "returns 201 when target_branch is specified and for the same project" do
-        post v3_api("/projects/#{fork_project.id}/merge_requests", user2),
-        title: 'Test merge_request', target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: fork_project.id
+        post v3_api("/projects/#{forked_project.id}/merge_requests", user2),
+        title: 'Test merge_request', target_branch: 'master', source_branch: 'markdown', author: user2, target_project_id: forked_project.id
         expect(response).to have_gitlab_http_status(201)
       end
     end
diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb
index 27d09b8202e..badc8bccf84 100644
--- a/spec/requests/lfs_http_spec.rb
+++ b/spec/requests/lfs_http_spec.rb
@@ -2,6 +2,7 @@ require 'spec_helper'
 
 describe 'Git LFS API and storage' do
   include WorkhorseHelpers
+  include ProjectForksHelper
 
   let(:user) { create(:user) }
   let!(:lfs_object) { create(:lfs_object, :with_file) }
@@ -1173,11 +1174,6 @@ describe 'Git LFS API and storage' do
     ActionController::HttpAuthentication::Basic.encode_credentials(user.username, Gitlab::LfsToken.new(user).token)
   end
 
-  def fork_project(project, user, object = nil)
-    allow(RepositoryForkWorker).to receive(:perform_async).and_return(true)
-    Projects::ForkService.new(project, user, {}).execute
-  end
-
   def post_lfs_json(url, body = nil, headers = nil)
     post(url, body.try(:to_json), (headers || {}).merge('Content-Type' => 'application/vnd.git-lfs+json'))
   end
diff --git a/spec/serializers/build_details_entity_spec.rb b/spec/serializers/build_details_entity_spec.rb
index 5b7822d5d8e..f6bd6e9ede4 100644
--- a/spec/serializers/build_details_entity_spec.rb
+++ b/spec/serializers/build_details_entity_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe BuildDetailsEntity do
+  include ProjectForksHelper
+
   set(:user) { create(:admin) }
 
   it 'inherits from JobEntity' do
@@ -56,18 +58,16 @@ describe BuildDetailsEntity do
       end
 
       context 'when merge request is from a fork' do
-        let(:fork_project) do
-          create(:project, forked_from_project: project)
-        end
+        let(:forked_project) { fork_project(project) }
 
-        let(:pipeline) { create(:ci_pipeline, project: fork_project) }
+        let(:pipeline) { create(:ci_pipeline, project: forked_project) }
 
         before do
           allow(build).to receive(:merge_request).and_return(merge_request)
         end
 
         let(:merge_request) do
-          create(:merge_request, source_project: fork_project,
+          create(:merge_request, source_project: forked_project,
                                  target_project: project,
                                  source_branch: build.ref)
         end
diff --git a/spec/services/ci/create_pipeline_service_spec.rb b/spec/services/ci/create_pipeline_service_spec.rb
index eb6e683cc23..08847183bf4 100644
--- a/spec/services/ci/create_pipeline_service_spec.rb
+++ b/spec/services/ci/create_pipeline_service_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Ci::CreatePipelineService do
+  include ProjectForksHelper
+
   set(:project) { create(:project, :repository) }
   let(:user) { create(:admin) }
   let(:ref_name) { 'refs/heads/master' }
@@ -82,13 +84,9 @@ describe Ci::CreatePipelineService do
         end
 
         context 'when merge request target project is different from source project' do
+          let!(:project) { fork_project(target_project, nil, repository: true) }
           let!(:target_project) { create(:project, :repository) }
 
-          let!(:forked_project_link) do
-            create(:forked_project_link, forked_to_project: project,
-                                         forked_from_project: target_project)
-          end
-
           it 'updates head pipeline for merge request' do
             merge_request = create(:merge_request, source_branch: 'master',
                                                    target_branch: "branch_1",
diff --git a/spec/services/delete_merged_branches_service_spec.rb b/spec/services/delete_merged_branches_service_spec.rb
index 03c682ae0d7..5a9eb359ee1 100644
--- a/spec/services/delete_merged_branches_service_spec.rb
+++ b/spec/services/delete_merged_branches_service_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe DeleteMergedBranchesService do
+  include ProjectForksHelper
+
   subject(:service) { described_class.new(project, project.owner) }
 
   let(:project) { create(:project, :repository) }
@@ -50,9 +52,9 @@ describe DeleteMergedBranchesService do
 
     context 'open merge requests' do
       it 'does not delete branches from open merge requests' do
-        fork_link = create(:forked_project_link, forked_from_project: project)
+        forked_project = fork_project(project)
         create(:merge_request, :opened, source_project: project, target_project: project, source_branch: 'branch-merged', target_branch: 'master')
-        create(:merge_request, :opened, source_project: fork_link.forked_to_project, target_project: project, target_branch: 'improve/awesome', source_branch: 'master')
+        create(:merge_request, :opened, source_project: forked_project, target_project: project, target_branch: 'improve/awesome', source_branch: 'master')
 
         service.execute
 
diff --git a/spec/services/merge_requests/conflicts/resolve_service_spec.rb b/spec/services/merge_requests/conflicts/resolve_service_spec.rb
index 6f49a65d795..9c9b0c4c4a1 100644
--- a/spec/services/merge_requests/conflicts/resolve_service_spec.rb
+++ b/spec/services/merge_requests/conflicts/resolve_service_spec.rb
@@ -1,14 +1,16 @@
 require 'spec_helper'
 
 describe MergeRequests::Conflicts::ResolveService do
+  include ProjectForksHelper
   let(:user) { create(:user) }
-  let(:project) { create(:project, :repository) }
-
-  let(:fork_project) do
-    create(:forked_project_with_submodules) do |fork_project|
-      fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-      fork_project.save
-    end
+  let(:project) { create(:project, :public, :repository) }
+
+  let(:forked_project) do
+    forked_project = fork_project(project, user)
+    TestEnv.copy_repo(forked_project,
+                      bare_repo: TestEnv.forked_repo_path_bare,
+                      refs: TestEnv::FORKED_BRANCH_SHA)
+    forked_project
   end
 
   let(:merge_request) do
@@ -19,7 +21,7 @@ describe MergeRequests::Conflicts::ResolveService do
 
   let(:merge_request_from_fork) do
     create(:merge_request,
-           source_branch: 'conflict-resolvable-fork', source_project: fork_project,
+           source_branch: 'conflict-resolvable-fork', source_project: forked_project,
            target_branch: 'conflict-start', target_project: project)
   end
 
@@ -114,7 +116,7 @@ describe MergeRequests::Conflicts::ResolveService do
         end
 
         it 'gets conflicts from the source project' do
-          expect(fork_project.repository.rugged).to receive(:merge_commits).and_call_original
+          expect(forked_project.repository.rugged).to receive(:merge_commits).and_call_original
           expect(project.repository.rugged).not_to receive(:merge_commits)
 
           resolve_conflicts
diff --git a/spec/services/merge_requests/get_urls_service_spec.rb b/spec/services/merge_requests/get_urls_service_spec.rb
index 25599dea19f..274624aa8bb 100644
--- a/spec/services/merge_requests/get_urls_service_spec.rb
+++ b/spec/services/merge_requests/get_urls_service_spec.rb
@@ -1,6 +1,8 @@
 require "spec_helper"
 
 describe MergeRequests::GetUrlsService do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :public, :repository) }
   let(:service) { described_class.new(project) }
   let(:source_branch) { "merge-test" }
@@ -85,7 +87,7 @@ describe MergeRequests::GetUrlsService do
 
     context 'pushing to existing branch from forked project' do
       let(:user) { create(:user) }
-      let!(:forked_project) { Projects::ForkService.new(project, user).execute }
+      let!(:forked_project) { fork_project(project, user, repository: true) }
       let!(:merge_request) { create(:merge_request, source_project: forked_project, target_project: project, source_branch: source_branch) }
       let(:changes) { existing_branch_changes }
       # Source project is now the forked one
diff --git a/spec/services/merge_requests/refresh_service_spec.rb b/spec/services/merge_requests/refresh_service_spec.rb
index 64e676f22a0..62dbe362ec8 100644
--- a/spec/services/merge_requests/refresh_service_spec.rb
+++ b/spec/services/merge_requests/refresh_service_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe MergeRequests::RefreshService do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
   let(:service) { described_class }
@@ -12,7 +14,8 @@ describe MergeRequests::RefreshService do
       group.add_owner(@user)
 
       @project = create(:project, :repository, namespace: group)
-      @fork_project = Projects::ForkService.new(@project, @user).execute
+      @fork_project = fork_project(@project, @user, repository: true)
+
       @merge_request = create(:merge_request,
                               source_project: @project,
                               source_branch: 'master',
@@ -311,8 +314,7 @@ describe MergeRequests::RefreshService do
 
       context 'when the merge request is sourced from a different project' do
         it 'creates a `MergeRequestsClosingIssues` record for each issue closed by a commit' do
-          forked_project = create(:project, :repository)
-          create(:forked_project_link, forked_to_project: forked_project, forked_from_project: @project)
+          forked_project = fork_project(@project, @user, repository: true)
 
           merge_request = create(:merge_request,
                                  target_branch: 'master',
diff --git a/spec/services/projects/fork_service_spec.rb b/spec/services/projects/fork_service_spec.rb
index a5ec4111b70..53862283a27 100644
--- a/spec/services/projects/fork_service_spec.rb
+++ b/spec/services/projects/fork_service_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Projects::ForkService do
+  include ProjectForksHelper
   let(:gitlab_shell) { Gitlab::Shell.new }
 
   describe 'fork by user' do
@@ -33,7 +34,7 @@ describe Projects::ForkService do
       end
 
       describe "successfully creates project in the user namespace" do
-        let(:to_project) { fork_project(@from_project, @to_user) }
+        let(:to_project) { fork_project(@from_project, @to_user, namespace: @to_user.namespace) }
 
         it { expect(to_project).to be_persisted }
         it { expect(to_project.errors).to be_empty }
@@ -93,7 +94,7 @@ describe Projects::ForkService do
     context 'project already exists' do
       it "fails due to validation, not transaction failure" do
         @existing_project = create(:project, :repository, creator_id: @to_user.id, name: @from_project.name, namespace: @to_namespace)
-        @to_project = fork_project(@from_project, @to_user)
+        @to_project = fork_project(@from_project, @to_user, namespace: @to_namespace)
         expect(@existing_project).to be_persisted
 
         expect(@to_project).not_to be_persisted
@@ -115,7 +116,7 @@ describe Projects::ForkService do
       end
 
       it 'does not allow creation' do
-        to_project = fork_project(@from_project, @to_user)
+        to_project = fork_project(@from_project, @to_user, namespace: @to_user.namespace)
 
         expect(to_project).not_to be_persisted
         expect(to_project.errors.messages).to have_key(:base)
@@ -209,9 +210,4 @@ describe Projects::ForkService do
       end
     end
   end
-
-  def fork_project(from_project, user, params = {})
-    allow(RepositoryForkWorker).to receive(:perform_async).and_return(true)
-    Projects::ForkService.new(from_project, user, params).execute
-  end
 end
diff --git a/spec/services/projects/update_service_spec.rb b/spec/services/projects/update_service_spec.rb
index d400304622e..3da222e2ed8 100644
--- a/spec/services/projects/update_service_spec.rb
+++ b/spec/services/projects/update_service_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::UpdateService, '#execute' do
+  include ProjectForksHelper
+
   let(:gitlab_shell) { Gitlab::Shell.new }
   let(:user) { create(:user) }
   let(:admin) { create(:admin) }
@@ -76,13 +78,7 @@ describe Projects::UpdateService, '#execute' do
 
   describe 'when updating project that has forks' do
     let(:project) { create(:project, :internal) }
-    let(:forked_project) { create(:forked_project_with_submodules, :internal) }
-
-    before do
-      forked_project.build_forked_project_link(forked_to_project_id: forked_project.id,
-                                               forked_from_project_id: project.id)
-      forked_project.save
-    end
+    let(:forked_project) { fork_project(project) }
 
     it 'updates forks visibility level when parent set to more restrictive' do
       opts = { visibility_level: Gitlab::VisibilityLevel::PRIVATE }
diff --git a/spec/support/project_forks_helper.rb b/spec/support/project_forks_helper.rb
new file mode 100644
index 00000000000..0d1c6792d13
--- /dev/null
+++ b/spec/support/project_forks_helper.rb
@@ -0,0 +1,58 @@
+module ProjectForksHelper
+  def fork_project(project, user = nil, params = {})
+    # Load the `fork_network` for the project to fork as there might be one that
+    # wasn't loaded yet.
+    project.reload unless project.fork_network
+
+    unless user
+      user = create(:user)
+      project.add_developer(user)
+    end
+
+    unless params[:namespace] || params[:namespace_id]
+      params[:namespace] = create(:group)
+      params[:namespace].add_owner(user)
+    end
+
+    service = Projects::ForkService.new(project, user, params)
+
+    create_repository = params.delete(:repository)
+    # Avoid creating a repository
+    unless create_repository
+      allow(RepositoryForkWorker).to receive(:perform_async).and_return(true)
+      shell = double('gitlab_shell', fork_repository: true)
+      allow(service).to receive(:gitlab_shell).and_return(shell)
+    end
+
+    forked_project = service.execute
+
+    # Reload the both projects so they know about their newly created fork_network
+    if forked_project.persisted?
+      project.reload
+      forked_project.reload
+    end
+
+    if create_repository
+      # The call to project.repository.after_import in RepositoryForkWorker does
+      # not reset the @exists variable of this forked_project.repository
+      # so we have to explicitely call this method to clear the @exists variable.
+      # of the instance we're returning here.
+      forked_project.repository.after_import
+
+      # We can't leave the hooks in place after a fork, as those would fail in tests
+      # The "internal" API is not available
+      FileUtils.rm_rf("#{forked_project.repository.path}/hooks")
+    end
+
+    forked_project
+  end
+
+  def fork_project_with_submodules(project, user = nil, params = {})
+    forked_project = fork_project(project, user, params)
+    TestEnv.copy_repo(forked_project,
+                      bare_repo: TestEnv.forked_repo_path_bare,
+                      refs: TestEnv::FORKED_BRANCH_SHA)
+
+    forked_project
+  end
+end
diff --git a/spec/views/projects/merge_requests/_commits.html.haml_spec.rb b/spec/views/projects/merge_requests/_commits.html.haml_spec.rb
index 98c7de9b709..efed2e02a1b 100644
--- a/spec/views/projects/merge_requests/_commits.html.haml_spec.rb
+++ b/spec/views/projects/merge_requests/_commits.html.haml_spec.rb
@@ -2,10 +2,11 @@ require 'spec_helper'
 
 describe 'projects/merge_requests/_commits.html.haml' do
   include Devise::Test::ControllerHelpers
+  include ProjectForksHelper
 
   let(:user) { create(:user) }
-  let(:target_project) { create(:project, :repository) }
-  let(:source_project) { create(:project, :repository, forked_from_project: target_project) }
+  let(:target_project) { create(:project, :public, :repository) }
+  let(:source_project) { fork_project(target_project, user, repository: true) }
 
   let(:merge_request) do
     create(:merge_request, :simple,
diff --git a/spec/views/projects/merge_requests/edit.html.haml_spec.rb b/spec/views/projects/merge_requests/edit.html.haml_spec.rb
index 69c7d0cbf28..9b74a7e1946 100644
--- a/spec/views/projects/merge_requests/edit.html.haml_spec.rb
+++ b/spec/views/projects/merge_requests/edit.html.haml_spec.rb
@@ -2,16 +2,19 @@ require 'spec_helper'
 
 describe 'projects/merge_requests/edit.html.haml' do
   include Devise::Test::ControllerHelpers
+  include ProjectForksHelper
 
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository) }
-  let(:fork_project) { create(:project, :repository, forked_from_project: project) }
-  let(:unlink_project) { Projects::UnlinkForkService.new(fork_project, user) }
+  let(:forked_project) { fork_project(project, user, repository: true) }
+  let(:unlink_project) { Projects::UnlinkForkService.new(forked_project, user) }
   let(:milestone) { create(:milestone, project: project) }
 
   let(:closed_merge_request) do
+    project.add_developer(user)
+
     create(:closed_merge_request,
-      source_project: fork_project,
+      source_project: forked_project,
       target_project: project,
       author: user,
       assignee: user,
diff --git a/spec/views/projects/merge_requests/show.html.haml_spec.rb b/spec/views/projects/merge_requests/show.html.haml_spec.rb
index 6f29d12373a..28d54c2fb77 100644
--- a/spec/views/projects/merge_requests/show.html.haml_spec.rb
+++ b/spec/views/projects/merge_requests/show.html.haml_spec.rb
@@ -2,16 +2,17 @@ require 'spec_helper'
 
 describe 'projects/merge_requests/show.html.haml' do
   include Devise::Test::ControllerHelpers
+  include ProjectForksHelper
 
   let(:user) { create(:user) }
-  let(:project) { create(:project, :repository) }
-  let(:fork_project) { create(:project, :repository, forked_from_project: project) }
-  let(:unlink_project) { Projects::UnlinkForkService.new(fork_project, user) }
+  let(:project) { create(:project, :public, :repository) }
+  let(:forked_project) { fork_project(project, user, repository: true) }
+  let(:unlink_project) { Projects::UnlinkForkService.new(forked_project, user) }
   let(:note) { create(:note_on_merge_request, project: project, noteable: closed_merge_request) }
 
   let(:closed_merge_request) do
     create(:closed_merge_request,
-      source_project: fork_project,
+      source_project: forked_project,
       target_project: project,
       author: user)
   end
@@ -52,7 +53,7 @@ describe 'projects/merge_requests/show.html.haml' do
   context 'when the merge request is open' do
     it 'closes the merge request if the source project does not exist' do
       closed_merge_request.update_attributes(state: 'open')
-      fork_project.destroy
+      forked_project.destroy
 
       render
 
diff --git a/spec/workers/namespaceless_project_destroy_worker_spec.rb b/spec/workers/namespaceless_project_destroy_worker_spec.rb
index 20cf580af8a..ed8cedc0079 100644
--- a/spec/workers/namespaceless_project_destroy_worker_spec.rb
+++ b/spec/workers/namespaceless_project_destroy_worker_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe NamespacelessProjectDestroyWorker do
+  include ProjectForksHelper
+
   subject { described_class.new }
 
   before do
@@ -55,9 +57,11 @@ describe NamespacelessProjectDestroyWorker do
 
       context 'project forked from another' do
         let!(:parent_project) { create(:project) }
-
-        before do
-          create(:forked_project_link, forked_to_project: project, forked_from_project: parent_project)
+        let(:project) do
+          namespaceless_project = fork_project(parent_project)
+          namespaceless_project.namespace_id = nil
+          namespaceless_project.save(validate: false)
+          namespaceless_project
         end
 
         it 'closes open merge requests' do
-- 
cgit v1.2.1


From df7f530d843ca03cfdff65b2bb230e00ec60b371 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Fri, 29 Sep 2017 19:02:02 +0200
Subject: Add a migration to populate fork networks

This uses the existing ForkedProjectLinks
---
 .../20170929131201_populate_fork_networks.rb       |  30 ++++++
 .../create_fork_network_memberships_range.rb       |  60 +++++++++++
 .../populate_fork_networks_range.rb                |  54 ++++++++++
 .../create_fork_network_memberships_range_spec.rb  | 117 +++++++++++++++++++++
 .../populate_fork_networks_range_spec.rb           |  85 +++++++++++++++
 5 files changed, 346 insertions(+)
 create mode 100644 db/migrate/20170929131201_populate_fork_networks.rb
 create mode 100644 lib/gitlab/background_migration/create_fork_network_memberships_range.rb
 create mode 100644 lib/gitlab/background_migration/populate_fork_networks_range.rb
 create mode 100644 spec/lib/gitlab/background_migration/create_fork_network_memberships_range_spec.rb
 create mode 100644 spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb

diff --git a/db/migrate/20170929131201_populate_fork_networks.rb b/db/migrate/20170929131201_populate_fork_networks.rb
new file mode 100644
index 00000000000..1214962770f
--- /dev/null
+++ b/db/migrate/20170929131201_populate_fork_networks.rb
@@ -0,0 +1,30 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class PopulateForkNetworks < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  MIGRATION = 'PopulateForkNetworksRange'.freeze
+  BATCH_SIZE = 100
+  DELAY_INTERVAL = 15.seconds
+
+  disable_ddl_transaction!
+
+  class ForkedProjectLink < ActiveRecord::Base
+    include EachBatch
+
+    self.table_name = 'forked_project_links'
+  end
+
+  def up
+    say 'Populating the `fork_networks` based on existing `forked_project_links`'
+
+    queue_background_migration_jobs_by_range_at_intervals(ForkedProjectLink, MIGRATION, DELAY_INTERVAL, batch_size: BATCH_SIZE)
+  end
+
+  def down
+    # nothing
+  end
+end
diff --git a/lib/gitlab/background_migration/create_fork_network_memberships_range.rb b/lib/gitlab/background_migration/create_fork_network_memberships_range.rb
new file mode 100644
index 00000000000..4b468e9cd58
--- /dev/null
+++ b/lib/gitlab/background_migration/create_fork_network_memberships_range.rb
@@ -0,0 +1,60 @@
+module Gitlab
+  module BackgroundMigration
+    class CreateForkNetworkMembershipsRange
+      RESCHEDULE_DELAY = 15
+
+      class ForkedProjectLink < ActiveRecord::Base
+        self.table_name = 'forked_project_links'
+      end
+
+      def perform(start_id, end_id)
+        log("Creating memberships for forks: #{start_id} - #{end_id}")
+
+        ActiveRecord::Base.connection.execute <<~INSERT_MEMBERS
+          INSERT INTO fork_network_members (fork_network_id, project_id, forked_from_project_id)
+
+          SELECT fork_network_members.fork_network_id,
+                 forked_project_links.forked_to_project_id,
+                 forked_project_links.forked_from_project_id
+
+          FROM forked_project_links
+
+          INNER JOIN fork_network_members
+              ON forked_project_links.forked_from_project_id = fork_network_members.project_id
+
+          WHERE forked_project_links.id BETWEEN #{start_id} AND #{end_id}
+          AND NOT EXISTS (
+            SELECT true
+            FROM fork_network_members existing_members
+            WHERE existing_members.project_id = forked_project_links.forked_to_project_id
+          )
+        INSERT_MEMBERS
+
+        if missing_members?(start_id, end_id)
+          BackgroundMigrationWorker.perform_in(RESCHEDULE_DELAY, "CreateForkNetworkMembershipsRange", [start_id, end_id])
+        end
+      end
+
+      def missing_members?(start_id, end_id)
+        count_sql = <<~MISSING_MEMBERS
+          SELECT COUNT(*)
+
+          FROM forked_project_links
+
+          WHERE NOT EXISTS (
+            SELECT true
+            FROM fork_network_members
+            WHERE fork_network_members.project_id = forked_project_links.forked_to_project_id
+          )
+          AND forked_project_links.id BETWEEN #{start_id} AND #{end_id}
+        MISSING_MEMBERS
+
+        ForkNetworkMember.count_by_sql(count_sql) > 0
+      end
+
+      def log(message)
+        Rails.logger.info("#{self.class.name} - #{message}")
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/background_migration/populate_fork_networks_range.rb b/lib/gitlab/background_migration/populate_fork_networks_range.rb
new file mode 100644
index 00000000000..6c355ed1e75
--- /dev/null
+++ b/lib/gitlab/background_migration/populate_fork_networks_range.rb
@@ -0,0 +1,54 @@
+module Gitlab
+  module BackgroundMigration
+    class PopulateForkNetworksRange
+      def perform(start_id, end_id)
+        log("Creating fork networks for forked project links: #{start_id} - #{end_id}")
+
+        ActiveRecord::Base.connection.execute <<~INSERT_NETWORKS
+        INSERT INTO fork_networks (root_project_id)
+          SELECT DISTINCT forked_project_links.forked_from_project_id
+
+          FROM forked_project_links
+
+          WHERE NOT EXISTS (
+            SELECT true
+            FROM forked_project_links inner_links
+            WHERE inner_links.forked_to_project_id = forked_project_links.forked_from_project_id
+          )
+          AND NOT EXISTS (
+            SELECT true
+            FROM fork_networks
+            WHERE forked_project_links.forked_from_project_id = fork_networks.root_project_id
+          )
+          AND forked_project_links.id BETWEEN #{start_id} AND #{end_id}
+        INSERT_NETWORKS
+
+        log("Creating memberships for root projects: #{start_id} - #{end_id}")
+
+        ActiveRecord::Base.connection.execute <<~INSERT_ROOT
+          INSERT INTO fork_network_members (fork_network_id, project_id)
+          SELECT DISTINCT fork_networks.id, fork_networks.root_project_id
+
+          FROM fork_networks
+
+          INNER JOIN forked_project_links
+              ON forked_project_links.forked_from_project_id = fork_networks.root_project_id
+
+          WHERE NOT EXISTS (
+            SELECT true
+            FROM fork_network_members
+            WHERE fork_network_members.project_id = fork_networks.root_project_id
+          )
+          AND forked_project_links.id BETWEEN #{start_id} AND #{end_id}
+        INSERT_ROOT
+
+        delay = BackgroundMigration::CreateForkNetworkMembershipsRange::RESCHEDULE_DELAY
+        BackgroundMigrationWorker.perform_in(delay, "CreateForkNetworkMembershipsRange", [start_id, end_id])
+      end
+
+      def log(message)
+        Rails.logger.info("#{self.class.name} - #{message}")
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/background_migration/create_fork_network_memberships_range_spec.rb b/spec/lib/gitlab/background_migration/create_fork_network_memberships_range_spec.rb
new file mode 100644
index 00000000000..1a4ea2bac48
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/create_fork_network_memberships_range_spec.rb
@@ -0,0 +1,117 @@
+require 'spec_helper'
+
+describe Gitlab::BackgroundMigration::CreateForkNetworkMembershipsRange, :migration, schema: 20170929131201 do
+  let(:migration) { described_class.new }
+
+  let(:base1) { create(:project) }
+  let(:base1_fork1) { create(:project) }
+  let(:base1_fork2) { create(:project) }
+
+  let(:base2) { create(:project) }
+  let(:base2_fork1) { create(:project) }
+  let(:base2_fork2) { create(:project) }
+
+  let(:fork_of_fork) { create(:project) }
+  let(:fork_of_fork2) { create(:project) }
+  let(:second_level_fork) { create(:project) }
+  let(:third_level_fork) { create(:project) }
+
+  let(:fork_network1) { fork_networks.find_by(root_project_id: base1.id) }
+  let(:fork_network2) { fork_networks.find_by(root_project_id: base2.id) }
+
+  let!(:forked_project_links) { table(:forked_project_links) }
+  let!(:fork_networks) { table(:fork_networks) }
+  let!(:fork_network_members) { table(:fork_network_members) }
+
+  before do
+    # The fork-network relation created for the forked project
+    fork_networks.create(id: 1, root_project_id: base1.id)
+    fork_network_members.create(project_id: base1.id, fork_network_id: 1)
+    fork_networks.create(id: 2, root_project_id: base2.id)
+    fork_network_members.create(project_id: base2.id, fork_network_id: 2)
+
+    # Normal fork links
+    forked_project_links.create(id: 1, forked_from_project_id: base1.id, forked_to_project_id: base1_fork1.id)
+    forked_project_links.create(id: 2, forked_from_project_id: base1.id, forked_to_project_id: base1_fork2.id)
+    forked_project_links.create(id: 3, forked_from_project_id: base2.id, forked_to_project_id: base2_fork1.id)
+    forked_project_links.create(id: 4, forked_from_project_id: base2.id, forked_to_project_id: base2_fork2.id)
+
+    # Fork links
+    forked_project_links.create(id: 5, forked_from_project_id: base1_fork1.id, forked_to_project_id: fork_of_fork.id)
+    forked_project_links.create(id: 6, forked_from_project_id: base1_fork1.id, forked_to_project_id: fork_of_fork2.id)
+
+    # Forks 3 levels down
+    forked_project_links.create(id: 7, forked_from_project_id: fork_of_fork.id, forked_to_project_id: second_level_fork.id)
+    forked_project_links.create(id: 8, forked_from_project_id: second_level_fork.id, forked_to_project_id: third_level_fork.id)
+
+    migration.perform(1, 8)
+  end
+
+  it 'creates a memberships for the direct forks' do
+    base1_fork1_membership = fork_network_members.find_by(fork_network_id: fork_network1.id,
+                                                          project_id: base1_fork1.id)
+    base1_fork2_membership = fork_network_members.find_by(fork_network_id: fork_network1.id,
+                                                          project_id: base1_fork2.id)
+    base2_fork1_membership = fork_network_members.find_by(fork_network_id: fork_network2.id,
+                                                          project_id: base2_fork1.id)
+    base2_fork2_membership = fork_network_members.find_by(fork_network_id: fork_network2.id,
+                                                          project_id: base2_fork2.id)
+
+    expect(base1_fork1_membership.forked_from_project_id).to eq(base1.id)
+    expect(base1_fork2_membership.forked_from_project_id).to eq(base1.id)
+    expect(base2_fork1_membership.forked_from_project_id).to eq(base2.id)
+    expect(base2_fork2_membership.forked_from_project_id).to eq(base2.id)
+  end
+
+  it 'adds the fork network members for forks of forks' do
+    fork_of_fork_membership = fork_network_members.find_by(project_id: fork_of_fork.id,
+                                                           fork_network_id: fork_network1.id)
+    fork_of_fork2_membership = fork_network_members.find_by(project_id: fork_of_fork2.id,
+                                                            fork_network_id: fork_network1.id)
+    second_level_fork_membership = fork_network_members.find_by(project_id: second_level_fork.id,
+                                                                fork_network_id: fork_network1.id)
+    third_level_fork_membership = fork_network_members.find_by(project_id: third_level_fork.id,
+                                                               fork_network_id: fork_network1.id)
+
+    expect(fork_of_fork_membership.forked_from_project_id).to eq(base1_fork1.id)
+    expect(fork_of_fork2_membership.forked_from_project_id).to eq(base1_fork1.id)
+    expect(second_level_fork_membership.forked_from_project_id).to eq(fork_of_fork.id)
+    expect(third_level_fork_membership.forked_from_project_id).to eq(second_level_fork.id)
+  end
+
+  it 'reschedules itself when there are missing members' do
+    allow(migration).to receive(:missing_members?).and_return(true)
+
+    expect(BackgroundMigrationWorker)
+      .to receive(:perform_in).with(described_class::RESCHEDULE_DELAY, "CreateForkNetworkMembershipsRange", [1, 3])
+
+    migration.perform(1, 3)
+  end
+
+  it 'can be repeated without effect' do
+    expect { fork_network_members.count }.not_to change { migration.perform(1, 7) }
+  end
+
+  it 'knows it is finished for this range' do
+    expect(migration.missing_members?(1, 7)).to be_falsy
+  end
+
+  context 'with more forks' do
+    before do
+      forked_project_links.create(id: 9, forked_from_project_id: fork_of_fork.id, forked_to_project_id: create(:project).id)
+      forked_project_links.create(id: 10, forked_from_project_id: fork_of_fork.id, forked_to_project_id: create(:project).id)
+    end
+
+    it 'only processes a single batch of links at a time' do
+      expect(fork_network_members.count).to eq(10)
+
+      migration.perform(8, 10)
+
+      expect(fork_network_members.count).to eq(12)
+    end
+
+    it 'knows when not all memberships withing a batch have been created' do
+      expect(migration.missing_members?(8, 10)).to be_truthy
+    end
+  end
+end
diff --git a/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb b/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb
new file mode 100644
index 00000000000..3ef1873e615
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb
@@ -0,0 +1,85 @@
+require 'spec_helper'
+
+describe Gitlab::BackgroundMigration::PopulateForkNetworksRange, :migration, schema: 20170929131201 do
+  let(:migration) { described_class.new }
+  let(:base1) { create(:project) }
+  let(:base1_fork1) { create(:project) }
+  let(:base1_fork2) { create(:project) }
+
+  let(:base2) { create(:project) }
+  let(:base2_fork1) { create(:project) }
+  let(:base2_fork2) { create(:project) }
+
+  let!(:forked_project_links) { table(:forked_project_links) }
+  let!(:fork_networks) { table(:fork_networks) }
+  let!(:fork_network_members) { table(:fork_network_members) }
+
+  let(:fork_network1) { fork_networks.find_by(root_project_id: base1.id) }
+  let(:fork_network2) { fork_networks.find_by(root_project_id: base2.id) }
+
+  before do
+    # A normal fork link
+    forked_project_links.create(id: 1,
+                                forked_from_project_id: base1.id,
+                                forked_to_project_id: base1_fork1.id)
+    forked_project_links.create(id: 2,
+                                forked_from_project_id: base1.id,
+                                forked_to_project_id: base1_fork2.id)
+
+    forked_project_links.create(id: 3,
+                                forked_from_project_id: base2.id,
+                                forked_to_project_id: base2_fork1.id)
+    forked_project_links.create(id: 4,
+                                forked_from_project_id: base2_fork1.id,
+                                forked_to_project_id: create(:project).id)
+
+    forked_project_links.create(id: 5,
+                                forked_from_project_id: base2.id,
+                                forked_to_project_id: base2_fork2.id)
+
+    migration.perform(1, 3)
+  end
+
+  it 'it creates the fork network' do
+    expect(fork_network1).not_to be_nil
+    expect(fork_network2).not_to be_nil
+  end
+
+  it 'does not create a fork network for a fork-of-fork' do
+    # perfrom the entire batch
+    migration.perform(1, 5)
+
+    expect(fork_networks.find_by(root_project_id: base2_fork1.id)).to be_nil
+  end
+
+  it 'creates memberships for the root of fork networks' do
+    base1_membership = fork_network_members.find_by(fork_network_id: fork_network1.id,
+                                                    project_id: base1.id)
+    base2_membership = fork_network_members.find_by(fork_network_id: fork_network2.id,
+                                                    project_id: base2.id)
+
+    expect(base1_membership).not_to be_nil
+    expect(base2_membership).not_to be_nil
+  end
+
+  it 'schedules a job for inserting memberships for forks-of-forks' do
+    delay = Gitlab::BackgroundMigration::CreateForkNetworkMembershipsRange::RESCHEDULE_DELAY
+
+    expect(BackgroundMigrationWorker)
+      .to receive(:perform_in).with(delay, "CreateForkNetworkMembershipsRange", [1, 3])
+
+    migration.perform(1, 3)
+  end
+
+  it 'only processes a single batch of links at a time' do
+    expect(fork_network_members.count).to eq(5)
+
+    migration.perform(3, 5)
+
+    expect(fork_network_members.count).to eq(7)
+  end
+
+  it 'can be repeated without effect' do
+    expect { migration.perform(1, 3) }.not_to change { fork_network_members.count }
+  end
+end
-- 
cgit v1.2.1


From 8160550439d2027c12d5556c8ce1f8afd250628a Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Sat, 30 Sep 2017 20:21:08 +0200
Subject: Remove membership from fork network when unlinking

---
 app/services/projects/unlink_fork_service.rb       |  1 +
 spec/services/projects/unlink_fork_service_spec.rb | 30 ++++++++++++++++------
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/app/services/projects/unlink_fork_service.rb b/app/services/projects/unlink_fork_service.rb
index f30b40423c8..abe414d0c05 100644
--- a/app/services/projects/unlink_fork_service.rb
+++ b/app/services/projects/unlink_fork_service.rb
@@ -16,6 +16,7 @@ module Projects
       refresh_forks_count(@project.forked_from_project)
 
       @project.forked_project_link.destroy
+      @project.fork_network_member.destroy
     end
 
     def refresh_forks_count(project)
diff --git a/spec/services/projects/unlink_fork_service_spec.rb b/spec/services/projects/unlink_fork_service_spec.rb
index 4f1ab697460..50d3a4ec982 100644
--- a/spec/services/projects/unlink_fork_service_spec.rb
+++ b/spec/services/projects/unlink_fork_service_spec.rb
@@ -1,19 +1,22 @@
 require 'spec_helper'
 
 describe Projects::UnlinkForkService do
-  subject { described_class.new(fork_project, user) }
+  include ProjectForksHelper
 
-  let(:fork_link) { create(:forked_project_link) }
-  let(:fork_project) { fork_link.forked_to_project }
+  subject { described_class.new(forked_project, user) }
+
+  let(:fork_link) { forked_project.forked_project_link }
+  let(:project) { create(:project, :public) }
+  let(:forked_project) { fork_project(project, user) }
   let(:user) { create(:user) }
 
   context 'with opened merge request on the source project' do
-    let(:merge_request) { create(:merge_request, source_project: fork_project, target_project: fork_link.forked_from_project) }
-    let(:mr_close_service) { MergeRequests::CloseService.new(fork_project, user) }
+    let(:merge_request) { create(:merge_request, source_project: forked_project, target_project: fork_link.forked_from_project) }
+    let(:mr_close_service) { MergeRequests::CloseService.new(forked_project, user) }
 
     before do
       allow(MergeRequests::CloseService).to receive(:new)
-        .with(fork_project, user)
+        .with(forked_project, user)
         .and_return(mr_close_service)
     end
 
@@ -25,13 +28,24 @@ describe Projects::UnlinkForkService do
   end
 
   it 'remove fork relation' do
-    expect(fork_project.forked_project_link).to receive(:destroy)
+    expect(forked_project.forked_project_link).to receive(:destroy)
+
+    subject.execute
+  end
+
+  it 'removes the link to the fork network' do
+    expect(forked_project.fork_network_member).to be_present
+    expect(forked_project.fork_network).to be_present
 
     subject.execute
+    forked_project.reload
+
+    expect(forked_project.fork_network_member).to be_nil
+    expect(forked_project.reload.fork_network).to be_nil
   end
 
   it 'refreshes the forks count cache of the source project' do
-    source = fork_project.forked_from_project
+    source = forked_project.forked_from_project
 
     expect(source.forks_count).to eq(1)
 
-- 
cgit v1.2.1


From f90b27da7777b0c72782d2a930f770e2f27757e2 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Tue, 3 Oct 2017 17:06:09 +0200
Subject: Find forks within users/namespaces using fork memberships

---
 app/models/fork_network.rb       |  4 ++++
 app/models/namespace.rb          |  4 +++-
 app/models/project.rb            |  5 +++++
 app/models/user.rb               | 10 +---------
 spec/factories/fork_networks.rb  |  5 +++++
 spec/models/fork_network_spec.rb | 12 ++++++++++++
 spec/models/namespace_spec.rb    | 23 +++++++++++++++++++++++
 spec/models/user_spec.rb         | 17 +++++++++++++++++
 8 files changed, 70 insertions(+), 10 deletions(-)
 create mode 100644 spec/factories/fork_networks.rb

diff --git a/app/models/fork_network.rb b/app/models/fork_network.rb
index fd2510d0a4c..218e37a5312 100644
--- a/app/models/fork_network.rb
+++ b/app/models/fork_network.rb
@@ -8,4 +8,8 @@ class ForkNetwork < ActiveRecord::Base
   def add_root_as_member
     projects << root_project
   end
+
+  def find_forks_in(other_projects)
+    projects.where(id: other_projects)
+  end
 end
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index e279d8dd8c5..4672881e220 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -139,7 +139,9 @@ class Namespace < ActiveRecord::Base
   end
 
   def find_fork_of(project)
-    projects.joins(:forked_project_link).find_by('forked_project_links.forked_from_project_id = ?', project.id)
+    return nil unless project.fork_network
+
+    project.fork_network.find_forks_in(projects).first
   end
 
   def lfs_enabled?
diff --git a/app/models/project.rb b/app/models/project.rb
index 4a883552a8d..ad1c339ae78 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1009,6 +1009,11 @@ class Project < ActiveRecord::Base
   end
 
   def forked?
+    return true if fork_network && fork_network.root_project != self
+
+    # TODO: Use only the above conditional using the `fork_network`
+    # This is the old conditional that looks at the `forked_project_link`, we
+    # fall back to this while we're migrating the new models
     !(forked_project_link.nil? || forked_project_link.forked_from_project.nil?)
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 959738ba608..c3f115ca074 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -697,15 +697,7 @@ class User < ActiveRecord::Base
   end
 
   def fork_of(project)
-    links = ForkedProjectLink.where(
-      forked_from_project_id: project,
-      forked_to_project_id: personal_projects.unscope(:order)
-    )
-    if links.any?
-      links.first.forked_to_project
-    else
-      nil
-    end
+    namespace.find_fork_of(project)
   end
 
   def ldap_user?
diff --git a/spec/factories/fork_networks.rb b/spec/factories/fork_networks.rb
new file mode 100644
index 00000000000..f42d36f3d19
--- /dev/null
+++ b/spec/factories/fork_networks.rb
@@ -0,0 +1,5 @@
+FactoryGirl.define do
+  factory :fork_network do
+    association :root_project, factory: :project
+  end
+end
diff --git a/spec/models/fork_network_spec.rb b/spec/models/fork_network_spec.rb
index 4781a959846..605ccd6db06 100644
--- a/spec/models/fork_network_spec.rb
+++ b/spec/models/fork_network_spec.rb
@@ -12,6 +12,18 @@ describe ForkNetwork do
     end
   end
 
+  describe '#find_fork_in' do
+    it 'finds all fork of the current network in al collection' do
+      network = create(:fork_network)
+      root_project = network.root_project
+      another_project = fork_project(root_project)
+      create(:project)
+
+      expect(network.find_forks_in(Project.all))
+               .to contain_exactly(another_project, root_project)
+    end
+  end
+
   context 'for a deleted project' do
     it 'keeps the fork network' do
       project = create(:project, :public)
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index 3ea614776ca..2ebf6acd42a 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Namespace do
+  include ProjectForksHelper
+
   let!(:namespace) { create(:namespace) }
 
   describe 'associations' do
@@ -520,4 +522,25 @@ describe Namespace do
       end
     end
   end
+
+  describe '#has_forks_of?' do
+    let(:project) { create(:project, :public) }
+    let!(:forked_project) { fork_project(project, namespace.owner, namespace: namespace) }
+
+    before do
+      # Reset the fork network relation
+      project.reload
+    end
+
+    it 'knows if there is a direct fork in the namespace' do
+      expect(namespace.find_fork_of(project)).to eq(forked_project)
+    end
+
+    it 'knows when there is as fork-of-fork in the namespace' do
+      other_namespace = create(:namespace)
+      other_fork = fork_project(forked_project, other_namespace.owner, namespace: other_namespace)
+
+      expect(other_namespace.find_fork_of(project)).to eq(other_fork)
+    end
+  end
 end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 52ca068f9a4..ece6968dde6 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1456,6 +1456,23 @@ describe User do
     end
   end
 
+  describe '#fork_of' do
+    let(:user) { create(:user) }
+
+    it "returns a user's fork of a project" do
+      project = create(:project, :public)
+      user_fork = fork_project(project, user, namespace: user.namespace)
+
+      expect(user.fork_of(project)).to eq(user_fork)
+    end
+
+    it 'returns nil if the project does not have a fork network' do
+      project = create(:project)
+
+      expect(user.fork_of(project)).to be_nil
+    end
+  end
+
   describe '#can_be_removed?' do
     subject { create(:user) }
 
-- 
cgit v1.2.1


From 14a6cebc9feefc45b587bf9b9b706194b9b5bff9 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Tue, 3 Oct 2017 18:27:51 +0200
Subject: Store the name of a project that's a root of a fork network

So we can keep showing it to a user in his project page.
---
 app/services/projects/destroy_service.rb       |  7 +++++++
 spec/services/projects/destroy_service_spec.rb | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/app/services/projects/destroy_service.rb b/app/services/projects/destroy_service.rb
index 54eb75ab9bf..19d75ff2efa 100644
--- a/app/services/projects/destroy_service.rb
+++ b/app/services/projects/destroy_service.rb
@@ -22,6 +22,13 @@ module Projects
 
       Projects::UnlinkForkService.new(project, current_user).execute
 
+      # The project is not necessarily a fork, so update the fork network originating
+      # from this project
+      if fork_network = project.root_of_fork_network
+        fork_network.update(root_project: nil,
+                            deleted_root_project_name: project.full_name)
+      end
+
       attempt_destroy_transaction(project)
 
       system_hook_service.execute_hooks_for(project, :destroy)
diff --git a/spec/services/projects/destroy_service_spec.rb b/spec/services/projects/destroy_service_spec.rb
index c867139d1de..c90bad46295 100644
--- a/spec/services/projects/destroy_service_spec.rb
+++ b/spec/services/projects/destroy_service_spec.rb
@@ -212,6 +212,19 @@ describe Projects::DestroyService do
     end
   end
 
+  context 'as the root of a fork network' do
+    let!(:fork_network) { create(:fork_network, root_project: project) }
+
+    it 'updates the fork network with the project name' do
+      destroy_project(project, user)
+
+      fork_network.reload
+
+      expect(fork_network.deleted_root_project_name).to eq(project.full_name)
+      expect(fork_network.root_project).to be_nil
+    end
+  end
+
   def destroy_project(project, user, params = {})
     if async
       Projects::DestroyService.new(project, user, params).async_execute
-- 
cgit v1.2.1


From 178f4e1e16b41f8e5992f484fdd6465090c55a08 Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Tue, 3 Oct 2017 19:41:37 +0200
Subject: Show fork information on the project panel

---
 app/views/projects/_home_panel.html.haml | 14 ++++--
 locale/gitlab.pot                        | 78 +++++++++++++++++++++++++++++++-
 spec/features/projects_spec.rb           | 49 ++++++++++++++++++++
 3 files changed, 135 insertions(+), 6 deletions(-)

diff --git a/app/views/projects/_home_panel.html.haml b/app/views/projects/_home_panel.html.haml
index 873b3045ea9..619b632918e 100644
--- a/app/views/projects/_home_panel.html.haml
+++ b/app/views/projects/_home_panel.html.haml
@@ -1,4 +1,6 @@
 - empty_repo = @project.empty_repo?
+- fork_network = @project.fork_network
+- forked_from_project = @project.forked_from_project || fork_network&.root_project
 .project-home-panel.text-center{ class: ("empty-project" if empty_repo) }
   .limit-container-width{ class: container_class }
     .avatar-container.s70.project-avatar
@@ -12,11 +14,15 @@
       - if @project.description.present?
         = markdown_field(@project, :description)
 
-      - if forked_from_project = @project.forked_from_project
+      - if @project.forked?
         %p
-          #{ s_('ForkedFromProjectPath|Forked from') }
-          = link_to project_path(forked_from_project) do
-            = forked_from_project.namespace.try(:name)
+          - if forked_from_project
+            #{ s_('ForkedFromProjectPath|Forked from') }
+            = link_to project_path(forked_from_project) do
+              = forked_from_project.full_name
+          - else
+            - deleted_message = s_('ForkedFromProjectPath|Forked from %{project_name} (deleted)')
+            = deleted_message % { project_name: fork_network.deleted_root_project_name }
 
     .project-repo-buttons
       .count-buttons
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 7569af9d175..c73e582e608 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -8,8 +8,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gitlab 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2017-10-04 23:47+0100\n"
-"PO-Revision-Date: 2017-10-04 23:47+0100\n"
+"POT-Creation-Date: 2017-10-06 18:33+0200\n"
+"PO-Revision-Date: 2017-10-06 18:33+0200\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -23,6 +23,11 @@ msgid_plural "%d commits"
 msgstr[0] ""
 msgstr[1] ""
 
+msgid "%d layer"
+msgid_plural "%d layers"
+msgstr[0] ""
+msgstr[1] ""
+
 msgid "%s additional commit has been omitted to prevent performance issues."
 msgid_plural "%s additional commits have been omitted to prevent performance issues."
 msgstr[0] ""
@@ -59,6 +64,9 @@ msgstr[1] ""
 msgid "1st contribution!"
 msgstr ""
 
+msgid "2FA enabled"
+msgstr ""
+
 msgid "A collection of graphs regarding Continuous Integration"
 msgstr ""
 
@@ -528,6 +536,51 @@ msgstr ""
 msgid "Compare"
 msgstr ""
 
+msgid "Container Registry"
+msgstr ""
+
+msgid "ContainerRegistry|Created"
+msgstr ""
+
+msgid "ContainerRegistry|First log in to GitLab&rsquo;s Container Registry using your GitLab username and password. If you have %{link_2fa} you need to use a %{link_token}:"
+msgstr ""
+
+msgid "ContainerRegistry|GitLab supports up to 3 levels of image names. The following examples of images are valid for your project:"
+msgstr ""
+
+msgid "ContainerRegistry|How to use the Container Registry"
+msgstr ""
+
+msgid "ContainerRegistry|Learn more about"
+msgstr ""
+
+msgid "ContainerRegistry|No tags in Container Registry for this container image."
+msgstr ""
+
+msgid "ContainerRegistry|Once you log in, you&rsquo;re free to create and upload a container image using the common %{build} and %{push} commands"
+msgstr ""
+
+msgid "ContainerRegistry|Remove repository"
+msgstr ""
+
+msgid "ContainerRegistry|Remove tag"
+msgstr ""
+
+msgid "ContainerRegistry|Size"
+msgstr ""
+
+msgid "ContainerRegistry|Tag"
+msgstr ""
+
+msgid "ContainerRegistry|Tag ID"
+msgstr ""
+
+msgid "ContainerRegistry|Use different image names"
+msgstr ""
+
+msgid "ContainerRegistry|With the Docker Container Registry integrated into GitLab, every project can have its own space to store its Docker images."
+msgstr ""
+
 msgid "Contribution guide"
 msgstr ""
 
@@ -739,6 +792,9 @@ msgstr[1] ""
 msgid "ForkedFromProjectPath|Forked from"
 msgstr ""
 
+msgid "ForkedFromProjectPath|Forked from %{project_name} (deleted)"
+msgstr ""
+
 msgid "Format"
 msgstr ""
 
@@ -949,6 +1005,9 @@ msgstr ""
 msgid "New tag"
 msgstr ""
 
+msgid "No container images stored for this project. Add one by following the instructions above."
+msgstr ""
+
 msgid "No repository"
 msgstr ""
 
@@ -1024,6 +1083,9 @@ msgstr ""
 msgid "OpenedNDaysAgo|Opened"
 msgstr ""
 
+msgid "Opens in a new window"
+msgstr ""
+
 msgid "Options"
 msgstr ""
 
@@ -1350,6 +1412,15 @@ msgstr[1] ""
 msgid "Snippets"
 msgstr ""
 
+msgid "Something went wrong on our end."
+msgstr ""
+
+msgid "Something went wrong while fetching the projects."
+msgstr ""
+
+msgid "Something went wrong while fetching the registry list."
+msgstr ""
+
 msgid "SortOptions|Access level, ascending"
 msgstr ""
 
@@ -1905,3 +1976,6 @@ msgid "parent"
 msgid_plural "parents"
 msgstr[0] ""
 msgstr[1] ""
+
+msgid "personal access token"
+msgstr ""
diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb
index b957575a244..4b2c54d54b5 100644
--- a/spec/features/projects_spec.rb
+++ b/spec/features/projects_spec.rb
@@ -77,6 +77,55 @@ feature 'Project' do
     end
   end
 
+  describe 'showing information about source of a project fork' do
+    let(:user) { create(:user) }
+    let(:base_project)  { create(:project, :public, :repository) }
+    let(:forked_project) { fork_project(base_project, user, repository: true) }
+
+    before do
+      sign_in user
+    end
+
+    it 'shows a link to the source project when it is available' do
+      visit project_path(forked_project)
+
+      expect(page).to have_content('Forked from')
+      expect(page).to have_link(base_project.full_name)
+    end
+
+    it 'does not contain fork network information for the root project' do
+      forked_project
+
+      visit project_path(base_project)
+
+      expect(page).not_to have_content('In fork network of')
+      expect(page).not_to have_content('Forked from')
+    end
+
+    it 'shows the name of the deleted project when the source was deleted' do
+      forked_project
+      Projects::DestroyService.new(base_project, base_project.owner).execute
+
+      visit project_path(forked_project)
+
+      expect(page).to have_content("Forked from #{base_project.full_name} (deleted)")
+    end
+
+    context 'a fork of a fork' do
+      let(:fork_of_fork) { fork_project(forked_project, user, repository: true) }
+
+      it 'links to the base project if the source project is removed' do
+        fork_of_fork
+        Projects::DestroyService.new(forked_project, user).execute
+
+        visit project_path(fork_of_fork)
+
+        expect(page).to have_content("Forked from")
+        expect(page).to have_link(base_project.full_name)
+      end
+    end
+  end
+
   describe 'removal', js: true do
     let(:user)    { create(:user, username: 'test', name: 'test') }
     let(:project) { create(:project, namespace: user.namespace, name: 'project1') }
-- 
cgit v1.2.1


From fc51bde939a24347e21b765b8c0e4238e2ffc67d Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Fri, 6 Oct 2017 12:36:34 +0200
Subject: Add a spec for editing a file when a project was already forked

---
 spec/features/projects/user_edits_files_spec.rb | 32 ++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/spec/features/projects/user_edits_files_spec.rb b/spec/features/projects/user_edits_files_spec.rb
index 19954313c23..2798041fa0c 100644
--- a/spec/features/projects/user_edits_files_spec.rb
+++ b/spec/features/projects/user_edits_files_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe 'User edits files' do
+  include ProjectForksHelper
   let(:project) { create(:project, :repository, name: 'Shop') }
   let(:project2) { create(:project, :repository, name: 'Another Project', path: 'another-project') }
   let(:project_tree_path_root_ref) { project_tree_path(project, project.repository.root_ref) }
@@ -122,7 +123,7 @@ describe 'User edits files' do
       fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Commit changes')
 
-      fork = user.fork_of(project2)
+      fork = user.fork_of(project2.reload)
 
       expect(current_path).to eq(project_new_merge_request_path(fork))
 
@@ -130,5 +131,34 @@ describe 'User edits files' do
 
       expect(page).to have_content('New commit message')
     end
+
+    context 'when the user already had a fork of the project', :js do
+      let!(:forked_project) { fork_project(project2, user, namespace: user.namespace, repository: true) }
+      before do
+        visit(project2_tree_path_root_ref)
+      end
+
+      it 'links to the forked project for editing' do
+        click_link('.gitignore')
+        find('.js-edit-blob').click
+
+        expect(page).not_to have_link('Fork')
+        expect(page).not_to have_button('Cancel')
+
+        execute_script("ace.edit('editor').setValue('*.rbca')")
+        fill_in(:commit_message, with: 'Another commit', visible: true)
+        click_button('Commit changes')
+
+        fork = user.fork_of(project2)
+
+        expect(current_path).to eq(project_new_merge_request_path(fork))
+
+        wait_for_requests
+
+        expect(page).to have_content('Another commit')
+        expect(page).to have_content("From #{forked_project.full_path}")
+        expect(page).to have_content("into #{project2.full_path}")
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 0ce6785851510ccb49f0d1edc0220aca46f815f5 Mon Sep 17 00:00:00 2001
From: Jacopo <beschi.jacopo@gmail.com>
Date: Tue, 3 Oct 2017 10:35:01 +0200
Subject: Replaces `tag: true` into `:tag` in the specs

Replaces all the explicit include metadata syntax in the specs (tag:
true) into the implicit one (:tag).
Added a cop to prevent future errors and handle autocorrection.
---
 .../unreleased/37552-replace-js-true-with-js.yml   |  5 ++
 rubocop/cop/rspec/verbose_include_metadata.rb      | 74 ++++++++++++++++++++++
 rubocop/rubocop.rb                                 |  1 +
 spec/controllers/projects_controller_spec.rb       |  2 +-
 spec/features/admin/admin_abuse_reports_spec.rb    |  2 +-
 .../admin/admin_broadcast_messages_spec.rb         |  2 +-
 .../admin/admin_disables_two_factor_spec.rb        |  2 +-
 spec/features/admin/admin_groups_spec.rb           | 10 +--
 spec/features/admin/admin_health_check_spec.rb     |  2 +-
 spec/features/admin/admin_hooks_spec.rb            |  2 +-
 spec/features/admin/admin_labels_spec.rb           |  2 +-
 spec/features/admin/admin_projects_spec.rb         |  8 +--
 .../admin/admin_users_impersonation_tokens_spec.rb |  2 +-
 spec/features/admin/admin_users_spec.rb            |  4 +-
 .../admin/admin_uses_repository_checks_spec.rb     |  2 +-
 spec/features/auto_deploy_spec.rb                  |  4 +-
 spec/features/boards/boards_spec.rb                |  2 +-
 spec/features/boards/keyboard_shortcut_spec.rb     |  2 +-
 spec/features/boards/new_issue_spec.rb             |  2 +-
 spec/features/boards/sidebar_spec.rb               |  2 +-
 spec/features/ci_lint_spec.rb                      |  2 +-
 spec/features/container_registry_spec.rb           |  2 +-
 spec/features/copy_as_gfm_spec.rb                  |  2 +-
 spec/features/cycle_analytics_spec.rb              |  2 +-
 spec/features/dashboard/active_tab_spec.rb         |  2 +-
 .../dashboard/datetime_on_tooltips_spec.rb         |  2 +-
 spec/features/dashboard/group_spec.rb              |  2 +-
 spec/features/dashboard/issues_spec.rb             |  8 +--
 spec/features/dashboard/label_filter_spec.rb       |  2 +-
 spec/features/dashboard/merge_requests_spec.rb     |  6 +-
 .../project_member_activity_index_spec.rb          |  2 +-
 spec/features/dashboard/projects_spec.rb           |  2 +-
 .../dashboard/todos/todos_filtering_spec.rb        |  2 +-
 spec/features/dashboard/todos/todos_spec.rb        |  8 +--
 spec/features/expand_collapse_diffs_spec.rb        |  2 +-
 spec/features/gitlab_flavored_markdown_spec.rb     |  2 +-
 spec/features/group_variables_spec.rb              |  2 +-
 spec/features/groups/labels/subscription_spec.rb   |  2 +-
 spec/features/groups_spec.rb                       |  6 +-
 spec/features/issuables/default_sort_order_spec.rb | 18 +++---
 spec/features/issuables/user_sees_sidebar_spec.rb  |  4 +-
 spec/features/issues/award_emoji_spec.rb           | 18 +++---
 spec/features/issues/award_spec.rb                 |  2 +-
 .../features/issues/bulk_assignment_labels_spec.rb |  2 +-
 ..._issue_for_discussions_in_merge_request_spec.rb |  2 +-
 ..._for_single_discussion_in_merge_request_spec.rb |  2 +-
 .../issues/filtered_search/dropdown_author_spec.rb |  2 +-
 .../issues/filtered_search/dropdown_emoji_spec.rb  |  2 +-
 .../issues/filtered_search/dropdown_label_spec.rb  |  2 +-
 .../issues/filtered_search/filter_issues_spec.rb   |  2 +-
 .../issues/filtered_search/recent_searches_spec.rb |  2 +-
 .../issues/filtered_search/search_bar_spec.rb      |  2 +-
 .../issues/filtered_search/visual_tokens_spec.rb   |  2 +-
 spec/features/issues/gfm_autocomplete_spec.rb      |  2 +-
 spec/features/issues/issue_sidebar_spec.rb         |  8 +--
 spec/features/issues/markdown_toolbar_spec.rb      |  2 +-
 spec/features/issues/move_spec.rb                  |  6 +-
 spec/features/issues/spam_issues_spec.rb           |  2 +-
 spec/features/issues/todo_spec.rb                  |  2 +-
 .../issues/user_uses_slash_commands_spec.rb        |  2 +-
 spec/features/issues_spec.rb                       | 28 ++++----
 spec/features/login_spec.rb                        |  8 +--
 spec/features/merge_requests/assign_issues_spec.rb |  2 +-
 spec/features/merge_requests/award_spec.rb         |  2 +-
 ...f_mergeable_with_unresolved_discussions_spec.rb |  2 +-
 spec/features/merge_requests/cherry_pick_spec.rb   |  2 +-
 spec/features/merge_requests/closes_issues_spec.rb |  2 +-
 spec/features/merge_requests/conflicts_spec.rb     |  2 +-
 spec/features/merge_requests/create_new_mr_spec.rb |  2 +-
 .../merge_requests/created_from_fork_spec.rb       |  6 +-
 .../merge_requests/deleted_source_branch_spec.rb   |  2 +-
 .../merge_requests/diff_notes_avatars_spec.rb      |  2 +-
 .../merge_requests/diff_notes_resolve_spec.rb      |  2 +-
 spec/features/merge_requests/diffs_spec.rb         |  2 +-
 spec/features/merge_requests/edit_mr_spec.rb       |  4 +-
 .../merge_requests/filter_by_milestone_spec.rb     |  8 +--
 .../merge_requests/filter_merge_requests_spec.rb   | 16 ++---
 spec/features/merge_requests/image_diff_notes.rb   |  2 +-
 .../merge_commit_message_toggle_spec.rb            |  2 +-
 .../only_allow_merge_if_build_succeeds_spec.rb     |  6 +-
 spec/features/merge_requests/pipelines_spec.rb     |  2 +-
 .../resolve_outdated_diff_discussions.rb           |  2 +-
 spec/features/merge_requests/target_branch_spec.rb |  2 +-
 .../toggle_whitespace_changes_spec.rb              |  2 +-
 .../merge_requests/toggler_behavior_spec.rb        |  2 +-
 .../merge_requests/update_merge_requests_spec.rb   |  6 +-
 .../user_uses_slash_commands_spec.rb               |  2 +-
 spec/features/merge_requests/versions_spec.rb      |  2 +-
 .../merge_requests/widget_deployments_spec.rb      |  2 +-
 spec/features/merge_requests/widget_spec.rb        |  2 +-
 spec/features/profiles/keys_spec.rb                |  2 +-
 spec/features/profiles/oauth_applications_spec.rb  |  2 +-
 .../profiles/personal_access_tokens_spec.rb        |  2 +-
 .../user_changes_notified_of_own_activity_spec.rb  |  2 +-
 .../profiles/user_visits_notifications_tab_spec.rb |  2 +-
 spec/features/projects/badges/list_spec.rb         |  2 +-
 .../blobs/blob_line_permalink_updater_spec.rb      |  2 +-
 spec/features/projects/blobs/edit_spec.rb          |  2 +-
 .../features/projects/blobs/shortcuts_blob_spec.rb |  2 +-
 spec/features/projects/branches_spec.rb            |  4 +-
 spec/features/projects/commit/builds_spec.rb       |  2 +-
 spec/features/projects/commit/cherry_pick_spec.rb  |  2 +-
 spec/features/projects/compare_spec.rb             |  2 +-
 ...eloper_views_empty_project_instructions_spec.rb |  4 +-
 spec/features/projects/edit_spec.rb                |  2 +-
 .../projects/environments/environments_spec.rb     |  2 +-
 spec/features/projects/features_visibility_spec.rb |  4 +-
 spec/features/projects/files/browse_files_spec.rb  |  2 +-
 .../projects/files/dockerfile_dropdown_spec.rb     |  2 +-
 .../projects/files/edit_file_soft_wrap_spec.rb     |  2 +-
 .../projects/files/find_file_keyboard_spec.rb      |  2 +-
 .../projects/files/gitignore_dropdown_spec.rb      |  2 +-
 .../projects/files/gitlab_ci_yml_dropdown_spec.rb  |  2 +-
 .../project_owner_creates_license_file_spec.rb     |  2 +-
 ...to_create_license_file_in_empty_project_spec.rb |  2 +-
 .../projects/files/template_type_dropdown_spec.rb  |  2 +-
 spec/features/projects/files/undo_template_spec.rb |  2 +-
 .../projects/gfm_autocomplete_load_spec.rb         |  2 +-
 .../projects/import_export/export_file_spec.rb     |  2 +-
 .../projects/import_export/import_file_spec.rb     |  2 +-
 .../import_export/namespace_export_file_spec.rb    |  2 +-
 spec/features/projects/issuable_templates_spec.rb  |  2 +-
 spec/features/projects/jobs_spec.rb                |  2 +-
 spec/features/projects/labels/subscription_spec.rb |  2 +-
 .../projects/labels/update_prioritization_spec.rb  | 10 +--
 ...uester_cannot_request_access_to_project_spec.rb |  2 +-
 .../members/groups_with_access_list_spec.rb        |  2 +-
 ...master_adds_member_with_expiration_date_spec.rb |  2 +-
 spec/features/projects/pipelines/pipelines_spec.rb |  4 +-
 spec/features/projects/project_settings_spec.rb    |  4 +-
 spec/features/projects/ref_switcher_spec.rb        |  2 +-
 .../projects/settings/integration_settings_spec.rb |  2 +-
 .../projects/settings/pipelines_settings_spec.rb   |  2 +-
 .../projects/settings/repository_settings_spec.rb  |  2 +-
 .../projects/settings/visibility_settings_spec.rb  |  2 +-
 spec/features/projects/show_project_spec.rb        |  2 +-
 spec/features/projects/user_browses_files_spec.rb  |  8 +--
 .../projects/user_creates_directory_spec.rb        |  2 +-
 spec/features/projects/user_creates_files_spec.rb  | 10 +--
 .../features/projects/user_creates_project_spec.rb |  2 +-
 spec/features/projects/user_deletes_files_spec.rb  |  4 +-
 spec/features/projects/user_edits_files_spec.rb    | 12 ++--
 .../projects/user_interacts_with_stars_spec.rb     |  2 +-
 spec/features/projects/user_replaces_files_spec.rb |  4 +-
 spec/features/projects/user_uploads_files_spec.rb  |  4 +-
 spec/features/projects/view_on_env_spec.rb         |  2 +-
 .../projects/wiki/markdown_preview_spec.rb         |  2 +-
 spec/features/projects_spec.rb                     |  4 +-
 spec/features/protected_tags_spec.rb               |  2 +-
 spec/features/snippets/internal_snippet_spec.rb    |  2 +-
 spec/features/tags/master_creates_tag_spec.rb      |  2 +-
 spec/features/tags/master_deletes_tag_spec.rb      |  6 +-
 spec/features/task_lists_spec.rb                   |  8 +--
 spec/features/triggers_spec.rb                     |  2 +-
 .../uploads/user_uploads_file_to_note_spec.rb      | 16 ++---
 spec/features/users/snippets_spec.rb               |  2 +-
 spec/features/users_spec.rb                        |  2 +-
 spec/features/variables_spec.rb                    |  2 +-
 spec/helpers/projects_helper_spec.rb               |  2 +-
 .../migrate_system_uploads_to_new_folder_spec.rb   |  2 +-
 spec/lib/gitlab/checks/force_push_spec.rb          |  2 +-
 .../v1/rename_base_spec.rb                         |  4 +-
 .../v1/rename_namespaces_spec.rb                   |  2 +-
 .../v1/rename_projects_spec.rb                     |  2 +-
 spec/lib/gitlab/git/blame_spec.rb                  |  2 +-
 spec/lib/gitlab/git/blob_spec.rb                   |  4 +-
 spec/lib/gitlab/git/commit_spec.rb                 |  6 +-
 spec/lib/gitlab/git/repository_spec.rb             | 24 +++----
 spec/lib/gitlab/git/tag_spec.rb                    |  2 +-
 spec/lib/gitlab/git_access_spec.rb                 |  4 +-
 spec/lib/gitlab/gitaly_client/ref_service_spec.rb  |  4 +-
 .../gitlab/health_checks/fs_shards_check_spec.rb   |  2 +-
 spec/lib/gitlab/shell_spec.rb                      |  4 +-
 spec/lib/gitlab/workhorse_spec.rb                  |  4 +-
 .../update_upload_paths_to_system_spec.rb          |  4 +-
 spec/models/member_spec.rb                         |  4 +-
 spec/models/project_group_link_spec.rb             |  2 +-
 spec/models/repository_spec.rb                     | 32 +++++-----
 spec/models/user_spec.rb                           |  4 +-
 .../cop/rspec/verbose_include_metadata_spec.rb     | 53 ++++++++++++++++
 .../issuable_slash_commands_shared_examples.rb     |  6 +-
 spec/workers/git_garbage_collect_worker_spec.rb    |  2 +-
 182 files changed, 461 insertions(+), 328 deletions(-)
 create mode 100644 changelogs/unreleased/37552-replace-js-true-with-js.yml
 create mode 100644 rubocop/cop/rspec/verbose_include_metadata.rb
 create mode 100644 spec/rubocop/cop/rspec/verbose_include_metadata_spec.rb

diff --git a/changelogs/unreleased/37552-replace-js-true-with-js.yml b/changelogs/unreleased/37552-replace-js-true-with-js.yml
new file mode 100644
index 00000000000..f7b614a8839
--- /dev/null
+++ b/changelogs/unreleased/37552-replace-js-true-with-js.yml
@@ -0,0 +1,5 @@
+---
+title: 'Replace `tag: true` into `:tag` in the specs'
+merge_request: 14653
+author: Jacopo Beschi @jacopo-beschi
+type: added
diff --git a/rubocop/cop/rspec/verbose_include_metadata.rb b/rubocop/cop/rspec/verbose_include_metadata.rb
new file mode 100644
index 00000000000..58390622d60
--- /dev/null
+++ b/rubocop/cop/rspec/verbose_include_metadata.rb
@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'rubocop-rspec'
+
+module RuboCop
+  module Cop
+    module RSpec
+      # Checks for verbose include metadata used in the specs.
+      #
+      # @example
+      #   # bad
+      #   describe MyClass, js: true do
+      #   end
+      #
+      #   # good
+      #   describe MyClass, :js do
+      #   end
+      class VerboseIncludeMetadata < Cop
+        MSG = 'Use `%s` instead of `%s`.'
+
+        SELECTORS = %i[describe context feature example_group it specify example scenario its].freeze
+
+        def_node_matcher :include_metadata, <<-PATTERN
+          (send {(const nil :RSpec) nil} {#{SELECTORS.map(&:inspect).join(' ')}}
+            !const
+            ...
+            (hash $...))
+        PATTERN
+
+        def_node_matcher :invalid_metadata?, <<-PATTERN
+          (pair
+            (sym $...)
+            (true))
+        PATTERN
+
+        def on_send(node)
+          invalid_metadata_matches(node) do |match|
+            add_offense(node, :expression, format(MSG, good(match), bad(match)))
+          end
+        end
+
+        def autocorrect(node)
+          lambda do |corrector|
+            invalid_metadata_matches(node) do |match|
+              corrector.replace(match.loc.expression, good(match))
+            end
+          end
+        end
+
+        private
+
+        def invalid_metadata_matches(node)
+          include_metadata(node) do |matches|
+            matches.select(&method(:invalid_metadata?)).each do |match|
+              yield match
+            end
+          end
+        end
+
+        def bad(match)
+          "#{metadata_key(match)}: true"
+        end
+
+        def good(match)
+          ":#{metadata_key(match)}"
+        end
+
+        def metadata_key(match)
+          match.children[0].source
+        end
+      end
+    end
+  end
+end
diff --git a/rubocop/rubocop.rb b/rubocop/rubocop.rb
index 1b6e8991a17..1df23899efb 100644
--- a/rubocop/rubocop.rb
+++ b/rubocop/rubocop.rb
@@ -21,3 +21,4 @@ require_relative 'cop/migration/reversible_add_column_with_default'
 require_relative 'cop/migration/timestamps'
 require_relative 'cop/migration/update_column_in_batches'
 require_relative 'cop/rspec/single_line_hook'
+require_relative 'cop/rspec/verbose_include_metadata'
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index d7148e888ab..0544afe31ed 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -141,7 +141,7 @@ describe ProjectsController do
       end
     end
 
-    context 'when the storage is not available', broken_storage: true do
+    context 'when the storage is not available', :broken_storage do
       set(:project) { create(:project, :broken_storage) }
 
       before do
diff --git a/spec/features/admin/admin_abuse_reports_spec.rb b/spec/features/admin/admin_abuse_reports_spec.rb
index 2144f6ba635..766cd4b0090 100644
--- a/spec/features/admin/admin_abuse_reports_spec.rb
+++ b/spec/features/admin/admin_abuse_reports_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe "Admin::AbuseReports", js: true  do
+describe "Admin::AbuseReports", :js  do
   let(:user) { create(:user) }
 
   context 'as an admin' do
diff --git a/spec/features/admin/admin_broadcast_messages_spec.rb b/spec/features/admin/admin_broadcast_messages_spec.rb
index cbccf370514..9cb351282a0 100644
--- a/spec/features/admin/admin_broadcast_messages_spec.rb
+++ b/spec/features/admin/admin_broadcast_messages_spec.rb
@@ -40,7 +40,7 @@ feature 'Admin Broadcast Messages' do
     expect(page).not_to have_content 'Migration to new server'
   end
 
-  scenario 'Live preview a customized broadcast message', js: true do
+  scenario 'Live preview a customized broadcast message', :js do
     fill_in 'broadcast_message_message', with: "Live **Markdown** previews. :tada:"
 
     page.within('.broadcast-message-preview') do
diff --git a/spec/features/admin/admin_disables_two_factor_spec.rb b/spec/features/admin/admin_disables_two_factor_spec.rb
index e214ae6b78d..6a97378391b 100644
--- a/spec/features/admin/admin_disables_two_factor_spec.rb
+++ b/spec/features/admin/admin_disables_two_factor_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 feature 'Admin disables 2FA for a user' do
-  scenario 'successfully', js: true do
+  scenario 'successfully', :js do
     sign_in(create(:admin))
     user = create(:user, :two_factor)
 
diff --git a/spec/features/admin/admin_groups_spec.rb b/spec/features/admin/admin_groups_spec.rb
index 3768727d8ae..771fb5253da 100644
--- a/spec/features/admin/admin_groups_spec.rb
+++ b/spec/features/admin/admin_groups_spec.rb
@@ -52,7 +52,7 @@ feature 'Admin Groups' do
       expect_selected_visibility(internal)
     end
 
-    scenario 'when entered in group path, it auto filled the group name', js: true do
+    scenario 'when entered in group path, it auto filled the group name', :js do
       visit admin_groups_path
       click_link "New group"
       group_path = 'gitlab'
@@ -81,7 +81,7 @@ feature 'Admin Groups' do
       expect_selected_visibility(group.visibility_level)
     end
 
-    scenario 'edit group path does not change group name', js: true do
+    scenario 'edit group path does not change group name', :js do
       group = create(:group, :private)
 
       visit admin_group_edit_path(group)
@@ -93,7 +93,7 @@ feature 'Admin Groups' do
     end
   end
 
-  describe 'add user into a group', js: true do
+  describe 'add user into a group', :js do
     shared_context 'adds user into a group' do
       it do
         visit admin_group_path(group)
@@ -124,7 +124,7 @@ feature 'Admin Groups' do
       group.add_user(:user, Gitlab::Access::OWNER)
     end
 
-    it 'adds admin a to a group as developer', js: true do
+    it 'adds admin a to a group as developer', :js do
       visit group_group_members_path(group)
 
       page.within '.users-group-form' do
@@ -141,7 +141,7 @@ feature 'Admin Groups' do
     end
   end
 
-  describe 'admin remove himself from a group', js: true do
+  describe 'admin remove himself from a group', :js do
     it 'removes admin from the group' do
       group.add_user(current_user, Gitlab::Access::DEVELOPER)
 
diff --git a/spec/features/admin/admin_health_check_spec.rb b/spec/features/admin/admin_health_check_spec.rb
index 37fd3e171eb..09e6965849a 100644
--- a/spec/features/admin/admin_health_check_spec.rb
+++ b/spec/features/admin/admin_health_check_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature "Admin Health Check", feature: true, broken_storage: true do
+feature "Admin Health Check", :feature, :broken_storage do
   include StubENV
 
   before do
diff --git a/spec/features/admin/admin_hooks_spec.rb b/spec/features/admin/admin_hooks_spec.rb
index 91f08dbad5d..2e65fcc5231 100644
--- a/spec/features/admin/admin_hooks_spec.rb
+++ b/spec/features/admin/admin_hooks_spec.rb
@@ -74,7 +74,7 @@ describe 'Admin::Hooks', :js do
     end
   end
 
-  describe 'Test', js: true do
+  describe 'Test', :js do
     before do
       WebMock.stub_request(:post, @system_hook.url)
       visit admin_hooks_path
diff --git a/spec/features/admin/admin_labels_spec.rb b/spec/features/admin/admin_labels_spec.rb
index ae9b47299e6..a5834056a1d 100644
--- a/spec/features/admin/admin_labels_spec.rb
+++ b/spec/features/admin/admin_labels_spec.rb
@@ -30,7 +30,7 @@ RSpec.describe 'admin issues labels' do
       end
     end
 
-    it 'deletes all labels', js: true do
+    it 'deletes all labels', :js do
       page.within '.labels' do
         page.all('.btn-remove').each do |remove|
           remove.click
diff --git a/spec/features/admin/admin_projects_spec.rb b/spec/features/admin/admin_projects_spec.rb
index f4f2505d436..94b12105088 100644
--- a/spec/features/admin/admin_projects_spec.rb
+++ b/spec/features/admin/admin_projects_spec.rb
@@ -28,7 +28,7 @@ describe "Admin::Projects"  do
       expect(page).not_to have_content(archived_project.name)
     end
 
-    it 'renders all projects', js: true do
+    it 'renders all projects', :js do
       find(:css, '#sort-projects-dropdown').click
       click_link 'Show archived projects'
 
@@ -37,7 +37,7 @@ describe "Admin::Projects"  do
       expect(page).to have_xpath("//span[@class='label label-warning']", text: 'archived')
     end
 
-    it 'renders only archived projects', js: true do
+    it 'renders only archived projects', :js do
       find(:css, '#sort-projects-dropdown').click
       click_link 'Show archived projects only'
 
@@ -74,7 +74,7 @@ describe "Admin::Projects"  do
         .to receive(:move_uploads_to_new_namespace).and_return(true)
     end
 
-    it 'transfers project to group web', js: true do
+    it 'transfers project to group web', :js do
       visit admin_project_path(project)
 
       click_button 'Search for Namespace'
@@ -91,7 +91,7 @@ describe "Admin::Projects"  do
       project.team << [user, :master]
     end
 
-    it 'adds admin a to a project as developer', js: true do
+    it 'adds admin a to a project as developer', :js do
       visit project_project_members_path(project)
 
       page.within '.users-project-form' do
diff --git a/spec/features/admin/admin_users_impersonation_tokens_spec.rb b/spec/features/admin/admin_users_impersonation_tokens_spec.rb
index 034682dae27..388d30828a7 100644
--- a/spec/features/admin/admin_users_impersonation_tokens_spec.rb
+++ b/spec/features/admin/admin_users_impersonation_tokens_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Admin > Users > Impersonation Tokens', js: true do
+describe 'Admin > Users > Impersonation Tokens', :js do
   let(:admin) { create(:admin) }
   let!(:user) { create(:user) }
 
diff --git a/spec/features/admin/admin_users_spec.rb b/spec/features/admin/admin_users_spec.rb
index e2e2b13cf8a..f9f4bd6f5b9 100644
--- a/spec/features/admin/admin_users_spec.rb
+++ b/spec/features/admin/admin_users_spec.rb
@@ -288,7 +288,7 @@ describe "Admin::Users" do
       end
     end
 
-    it 'allows group membership to be revoked', js: true do
+    it 'allows group membership to be revoked', :js do
       page.within(first('.group_member')) do
         find('.btn-remove').click
       end
@@ -309,7 +309,7 @@ describe "Admin::Users" do
     end
   end
 
-  describe 'remove users secondary email', js: true do
+  describe 'remove users secondary email', :js do
     let!(:secondary_email) do
       create :email, email: 'secondary@example.com', user: user
     end
diff --git a/spec/features/admin/admin_uses_repository_checks_spec.rb b/spec/features/admin/admin_uses_repository_checks_spec.rb
index c2b7543a690..42f5b5eb8dc 100644
--- a/spec/features/admin/admin_uses_repository_checks_spec.rb
+++ b/spec/features/admin/admin_uses_repository_checks_spec.rb
@@ -32,7 +32,7 @@ feature 'Admin uses repository checks' do
     end
   end
 
-  scenario 'to clear all repository checks', js: true do
+  scenario 'to clear all repository checks', :js do
     visit admin_application_settings_path
 
     expect(RepositoryCheck::ClearWorker).to receive(:perform_async)
diff --git a/spec/features/auto_deploy_spec.rb b/spec/features/auto_deploy_spec.rb
index dff6f96b663..4a7c3e4f1ab 100644
--- a/spec/features/auto_deploy_spec.rb
+++ b/spec/features/auto_deploy_spec.rb
@@ -31,7 +31,7 @@ describe 'Auto deploy' do
       expect(page).to have_link('Set up auto deploy')
     end
 
-    it 'includes OpenShift as an available template', js: true do
+    it 'includes OpenShift as an available template', :js do
       click_link 'Set up auto deploy'
       click_button 'Apply a GitLab CI Yaml template'
 
@@ -40,7 +40,7 @@ describe 'Auto deploy' do
       end
     end
 
-    it 'creates a merge request using "auto-deploy" branch', js: true do
+    it 'creates a merge request using "auto-deploy" branch', :js do
       click_link 'Set up auto deploy'
       click_button 'Apply a GitLab CI Yaml template'
       within '.gitlab-ci-yml-selector' do
diff --git a/spec/features/boards/boards_spec.rb b/spec/features/boards/boards_spec.rb
index 33aca6cb527..91c4e5037de 100644
--- a/spec/features/boards/boards_spec.rb
+++ b/spec/features/boards/boards_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Issue Boards', js: true do
+describe 'Issue Boards', :js do
   include DragTo
 
   let(:group) { create(:group, :nested) }
diff --git a/spec/features/boards/keyboard_shortcut_spec.rb b/spec/features/boards/keyboard_shortcut_spec.rb
index 61b53aa5d1e..435de3861cf 100644
--- a/spec/features/boards/keyboard_shortcut_spec.rb
+++ b/spec/features/boards/keyboard_shortcut_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Issue Boards shortcut', js: true do
+describe 'Issue Boards shortcut', :js do
   let(:project) { create(:project) }
 
   before do
diff --git a/spec/features/boards/new_issue_spec.rb b/spec/features/boards/new_issue_spec.rb
index f67372337ec..5ac4d87e90b 100644
--- a/spec/features/boards/new_issue_spec.rb
+++ b/spec/features/boards/new_issue_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Issue Boards new issue', js: true do
+describe 'Issue Boards new issue', :js do
   let(:project) { create(:project, :public) }
   let(:board)   { create(:board, project: project) }
   let!(:list)   { create(:list, board: board, position: 0) }
diff --git a/spec/features/boards/sidebar_spec.rb b/spec/features/boards/sidebar_spec.rb
index c3bf50ef9d1..c4817eb947b 100644
--- a/spec/features/boards/sidebar_spec.rb
+++ b/spec/features/boards/sidebar_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Issue Boards', js: true do
+describe 'Issue Boards', :js do
   let(:user)         { create(:user) }
   let(:user2)        { create(:user) }
   let(:project)      { create(:project, :public) }
diff --git a/spec/features/ci_lint_spec.rb b/spec/features/ci_lint_spec.rb
index af4cc00162a..9accd7bb07c 100644
--- a/spec/features/ci_lint_spec.rb
+++ b/spec/features/ci_lint_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'CI Lint', js: true do
+describe 'CI Lint', :js do
   before do
     sign_in(create(:user))
   end
diff --git a/spec/features/container_registry_spec.rb b/spec/features/container_registry_spec.rb
index 45213dc6995..d5e9de20e59 100644
--- a/spec/features/container_registry_spec.rb
+++ b/spec/features/container_registry_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe "Container Registry", js: true do
+describe "Container Registry", :js do
   let(:user) { create(:user) }
   let(:project) { create(:project) }
 
diff --git a/spec/features/copy_as_gfm_spec.rb b/spec/features/copy_as_gfm_spec.rb
index ebcd0ba0dcd..c6ba1211b9e 100644
--- a/spec/features/copy_as_gfm_spec.rb
+++ b/spec/features/copy_as_gfm_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Copy as GFM', js: true do
+describe 'Copy as GFM', :js do
   include MarkupHelper
   include RepoHelpers
   include ActionView::Helpers::JavaScriptHelper
diff --git a/spec/features/cycle_analytics_spec.rb b/spec/features/cycle_analytics_spec.rb
index bfe9dac3bd4..177cd50dd72 100644
--- a/spec/features/cycle_analytics_spec.rb
+++ b/spec/features/cycle_analytics_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Cycle Analytics', js: true do
+feature 'Cycle Analytics', :js do
   let(:user) { create(:user) }
   let(:guest) { create(:user) }
   let(:project) { create(:project, :repository) }
diff --git a/spec/features/dashboard/active_tab_spec.rb b/spec/features/dashboard/active_tab_spec.rb
index 08d8cc7922b..8bab501134b 100644
--- a/spec/features/dashboard/active_tab_spec.rb
+++ b/spec/features/dashboard/active_tab_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-RSpec.describe 'Dashboard Active Tab', js: true do
+RSpec.describe 'Dashboard Active Tab', :js do
   before do
     sign_in(create(:user))
   end
diff --git a/spec/features/dashboard/datetime_on_tooltips_spec.rb b/spec/features/dashboard/datetime_on_tooltips_spec.rb
index b6dce1b8ec4..349f9a47112 100644
--- a/spec/features/dashboard/datetime_on_tooltips_spec.rb
+++ b/spec/features/dashboard/datetime_on_tooltips_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Tooltips on .timeago dates', js: true do
+feature 'Tooltips on .timeago dates', :js do
   let(:user)            { create(:user) }
   let(:project)         { create(:project, name: 'test', namespace: user.namespace) }
   let(:created_date)    { Date.yesterday.to_time }
diff --git a/spec/features/dashboard/group_spec.rb b/spec/features/dashboard/group_spec.rb
index 60a16830cdc..970173c7aaf 100644
--- a/spec/features/dashboard/group_spec.rb
+++ b/spec/features/dashboard/group_spec.rb
@@ -5,7 +5,7 @@ RSpec.describe 'Dashboard Group' do
     sign_in(create(:user))
   end
 
-  it 'creates new group', js: true do
+  it 'creates new group', :js do
     visit dashboard_groups_path
     find('.btn-new').trigger('click')
     new_path = 'Samurai'
diff --git a/spec/features/dashboard/issues_spec.rb b/spec/features/dashboard/issues_spec.rb
index 795335aa106..5610894fd9a 100644
--- a/spec/features/dashboard/issues_spec.rb
+++ b/spec/features/dashboard/issues_spec.rb
@@ -24,7 +24,7 @@ RSpec.describe 'Dashboard Issues' do
       expect(page).not_to have_content(other_issue.title)
     end
 
-    it 'shows checkmark when unassigned is selected for assignee', js: true do
+    it 'shows checkmark when unassigned is selected for assignee', :js do
       find('.js-assignee-search').click
       find('li', text: 'Unassigned').click
       find('.js-assignee-search').click
@@ -32,7 +32,7 @@ RSpec.describe 'Dashboard Issues' do
       expect(find('li[data-user-id="0"] a.is-active')).to be_visible
     end
 
-    it 'shows issues when current user is author', js: true do
+    it 'shows issues when current user is author', :js do
       find('#assignee_id', visible: false).set('')
       find('.js-author-search', match: :first).click
 
@@ -70,7 +70,7 @@ RSpec.describe 'Dashboard Issues' do
   end
 
   describe 'new issue dropdown' do
-    it 'shows projects only with issues feature enabled', js: true do
+    it 'shows projects only with issues feature enabled', :js do
       find('.new-project-item-select-button').trigger('click')
 
       page.within('.select2-results') do
@@ -79,7 +79,7 @@ RSpec.describe 'Dashboard Issues' do
       end
     end
 
-    it 'shows the new issue page', js: true do
+    it 'shows the new issue page', :js do
       find('.new-project-item-select-button').trigger('click')
 
       wait_for_requests
diff --git a/spec/features/dashboard/label_filter_spec.rb b/spec/features/dashboard/label_filter_spec.rb
index b1a207682c3..6802974c2ee 100644
--- a/spec/features/dashboard/label_filter_spec.rb
+++ b/spec/features/dashboard/label_filter_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Dashboard > label filter', js: true do
+describe 'Dashboard > label filter', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, name: 'test', namespace: user.namespace) }
   let(:project2) { create(:project, name: 'test2', path: 'test2', namespace: user.namespace) }
diff --git a/spec/features/dashboard/merge_requests_spec.rb b/spec/features/dashboard/merge_requests_spec.rb
index d26428ec286..f01ba442e58 100644
--- a/spec/features/dashboard/merge_requests_spec.rb
+++ b/spec/features/dashboard/merge_requests_spec.rb
@@ -24,7 +24,7 @@ feature 'Dashboard Merge Requests' do
       visit merge_requests_dashboard_path
     end
 
-    it 'shows projects only with merge requests feature enabled', js: true do
+    it 'shows projects only with merge requests feature enabled', :js do
       find('.new-project-item-select-button').trigger('click')
 
       page.within('.select2-results') do
@@ -89,7 +89,7 @@ feature 'Dashboard Merge Requests' do
       expect(page).not_to have_content(other_merge_request.title)
     end
 
-    it 'shows authored merge requests', js: true do
+    it 'shows authored merge requests', :js do
       filter_item_select('Any Assignee', '.js-assignee-search')
       filter_item_select(current_user.to_reference, '.js-author-search')
 
@@ -101,7 +101,7 @@ feature 'Dashboard Merge Requests' do
       expect(page).not_to have_content(other_merge_request.title)
     end
 
-    it 'shows all merge requests', js: true do
+    it 'shows all merge requests', :js do
       filter_item_select('Any Assignee', '.js-assignee-search')
       filter_item_select('Any Author', '.js-author-search')
 
diff --git a/spec/features/dashboard/project_member_activity_index_spec.rb b/spec/features/dashboard/project_member_activity_index_spec.rb
index 4a004107408..8f96899fb4f 100644
--- a/spec/features/dashboard/project_member_activity_index_spec.rb
+++ b/spec/features/dashboard/project_member_activity_index_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Project member activity', js: true do
+feature 'Project member activity', :js do
   let(:user)            { create(:user) }
   let(:project)         { create(:project, :public, name: 'x', namespace: user.namespace) }
 
diff --git a/spec/features/dashboard/projects_spec.rb b/spec/features/dashboard/projects_spec.rb
index 4da95ccc169..fbf8b5c0db6 100644
--- a/spec/features/dashboard/projects_spec.rb
+++ b/spec/features/dashboard/projects_spec.rb
@@ -80,7 +80,7 @@ feature 'Dashboard Projects' do
     end
   end
 
-  describe 'with a pipeline', clean_gitlab_redis_shared_state: true do
+  describe 'with a pipeline', :clean_gitlab_redis_shared_state do
     let(:pipeline) { create(:ci_pipeline, project: project, sha: project.commit.sha) }
 
     before do
diff --git a/spec/features/dashboard/todos/todos_filtering_spec.rb b/spec/features/dashboard/todos/todos_filtering_spec.rb
index 54d477f7274..ad0f132da8c 100644
--- a/spec/features/dashboard/todos/todos_filtering_spec.rb
+++ b/spec/features/dashboard/todos/todos_filtering_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Dashboard > User filters todos', js: true do
+feature 'Dashboard > User filters todos', :js do
   let(:user_1)    { create(:user, username: 'user_1', name: 'user_1') }
   let(:user_2)    { create(:user, username: 'user_2', name: 'user_2') }
 
diff --git a/spec/features/dashboard/todos/todos_spec.rb b/spec/features/dashboard/todos/todos_spec.rb
index 30bab7eeaa7..01aca443f4a 100644
--- a/spec/features/dashboard/todos/todos_spec.rb
+++ b/spec/features/dashboard/todos/todos_spec.rb
@@ -17,7 +17,7 @@ feature 'Dashboard Todos' do
     end
   end
 
-  context 'User has a todo', js: true do
+  context 'User has a todo', :js do
     before do
       create(:todo, :mentioned, user: user, project: project, target: issue, author: author)
       sign_in(user)
@@ -177,7 +177,7 @@ feature 'Dashboard Todos' do
     end
   end
 
-  context 'User has done todos', js: true do
+  context 'User has done todos', :js do
     before do
       create(:todo, :mentioned, :done, user: user, project: project, target: issue, author: author)
       sign_in(user)
@@ -249,7 +249,7 @@ feature 'Dashboard Todos' do
       expect(page).to have_selector('.gl-pagination .page', count: 2)
     end
 
-    describe 'mark all as done', js: true do
+    describe 'mark all as done', :js do
       before do
         visit dashboard_todos_path
         find('.js-todos-mark-all').trigger('click')
@@ -267,7 +267,7 @@ feature 'Dashboard Todos' do
       end
     end
 
-    describe 'undo mark all as done', js: true do
+    describe 'undo mark all as done', :js do
       before do
         visit dashboard_todos_path
       end
diff --git a/spec/features/expand_collapse_diffs_spec.rb b/spec/features/expand_collapse_diffs_spec.rb
index 357d86497d9..1dd7547a7fc 100644
--- a/spec/features/expand_collapse_diffs_spec.rb
+++ b/spec/features/expand_collapse_diffs_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Expand and collapse diffs', js: true do
+feature 'Expand and collapse diffs', :js do
   let(:branch) { 'expand-collapse-diffs' }
   let(:project) { create(:project, :repository) }
 
diff --git a/spec/features/gitlab_flavored_markdown_spec.rb b/spec/features/gitlab_flavored_markdown_spec.rb
index 53b3bb3b65f..3c2186b3598 100644
--- a/spec/features/gitlab_flavored_markdown_spec.rb
+++ b/spec/features/gitlab_flavored_markdown_spec.rb
@@ -49,7 +49,7 @@ describe "GitLab Flavored Markdown" do
     end
   end
 
-  describe "for issues", js: true do
+  describe "for issues", :js do
     before do
       @other_issue = create(:issue,
                             author: user,
diff --git a/spec/features/group_variables_spec.rb b/spec/features/group_variables_spec.rb
index 37814ba6238..d2d0be35f1c 100644
--- a/spec/features/group_variables_spec.rb
+++ b/spec/features/group_variables_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Group variables', js: true do
+feature 'Group variables', :js do
   let(:user) { create(:user) }
   let(:group) { create(:group) }
 
diff --git a/spec/features/groups/labels/subscription_spec.rb b/spec/features/groups/labels/subscription_spec.rb
index 1dd09d4f203..2e06caf98f6 100644
--- a/spec/features/groups/labels/subscription_spec.rb
+++ b/spec/features/groups/labels/subscription_spec.rb
@@ -11,7 +11,7 @@ feature 'Labels subscription' do
       gitlab_sign_in user
     end
 
-    scenario 'users can subscribe/unsubscribe to group labels', js: true do
+    scenario 'users can subscribe/unsubscribe to group labels', :js do
       visit group_labels_path(group)
 
       expect(page).to have_content('feature')
diff --git a/spec/features/groups_spec.rb b/spec/features/groups_spec.rb
index 4ec2e7e6012..862823d862e 100644
--- a/spec/features/groups_spec.rb
+++ b/spec/features/groups_spec.rb
@@ -85,7 +85,7 @@ feature 'Group' do
     end
   end
 
-  describe 'create a nested group', :nested_groups, js: true do
+  describe 'create a nested group', :nested_groups, :js do
     let(:group) { create(:group, path: 'foo') }
 
     context 'as admin' do
@@ -142,7 +142,7 @@ feature 'Group' do
     expect(page).not_to have_content('secret-group')
   end
 
-  describe 'group edit', js: true do
+  describe 'group edit', :js do
     let(:group) { create(:group) }
     let(:path)  { edit_group_path(group) }
     let(:new_name) { 'new-name' }
@@ -207,7 +207,7 @@ feature 'Group' do
     end
   end
 
-  describe 'group page with nested groups', :nested_groups, js: true do
+  describe 'group page with nested groups', :nested_groups, :js do
     let!(:group) { create(:group) }
     let!(:nested_group) { create(:group, parent: group) }
     let!(:path)  { group_path(group) }
diff --git a/spec/features/issuables/default_sort_order_spec.rb b/spec/features/issuables/default_sort_order_spec.rb
index 925d026ed61..caee7a67aec 100644
--- a/spec/features/issuables/default_sort_order_spec.rb
+++ b/spec/features/issuables/default_sort_order_spec.rb
@@ -26,7 +26,7 @@ describe 'Projects > Issuables > Default sort order' do
       MergeRequest.all
     end
 
-    context 'in the "merge requests" tab', js: true do
+    context 'in the "merge requests" tab', :js do
       let(:issuable_type) { :merge_request }
 
       it 'is "last created"' do
@@ -37,7 +37,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "merge requests / open" tab', js: true do
+    context 'in the "merge requests / open" tab', :js do
       let(:issuable_type) { :merge_request }
 
       it 'is "created date"' do
@@ -49,7 +49,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "merge requests / merged" tab', js: true do
+    context 'in the "merge requests / merged" tab', :js do
       let(:issuable_type) { :merged_merge_request }
 
       it 'is "last updated"' do
@@ -61,7 +61,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "merge requests / closed" tab', js: true do
+    context 'in the "merge requests / closed" tab', :js do
       let(:issuable_type) { :closed_merge_request }
 
       it 'is "last updated"' do
@@ -73,7 +73,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "merge requests / all" tab', js: true do
+    context 'in the "merge requests / all" tab', :js do
       let(:issuable_type) { :merge_request }
 
       it 'is "created date"' do
@@ -102,7 +102,7 @@ describe 'Projects > Issuables > Default sort order' do
       Issue.all
     end
 
-    context 'in the "issues" tab', js: true do
+    context 'in the "issues" tab', :js do
       let(:issuable_type) { :issue }
 
       it 'is "created date"' do
@@ -114,7 +114,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "issues / open" tab', js: true do
+    context 'in the "issues / open" tab', :js do
       let(:issuable_type) { :issue }
 
       it 'is "created date"' do
@@ -126,7 +126,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "issues / closed" tab', js: true do
+    context 'in the "issues / closed" tab', :js do
       let(:issuable_type) { :closed_issue }
 
       it 'is "last updated"' do
@@ -138,7 +138,7 @@ describe 'Projects > Issuables > Default sort order' do
       end
     end
 
-    context 'in the "issues / all" tab', js: true do
+    context 'in the "issues / all" tab', :js do
       let(:issuable_type) { :issue }
 
       it 'is "created date"' do
diff --git a/spec/features/issuables/user_sees_sidebar_spec.rb b/spec/features/issuables/user_sees_sidebar_spec.rb
index 2bd1c8aab86..c6c2e58ecea 100644
--- a/spec/features/issuables/user_sees_sidebar_spec.rb
+++ b/spec/features/issuables/user_sees_sidebar_spec.rb
@@ -12,7 +12,7 @@ describe 'Issue Sidebar on Mobile' do
     sign_in(user)
   end
 
-  context 'mobile sidebar on merge requests', js: true do
+  context 'mobile sidebar on merge requests', :js do
     before do
       visit project_merge_request_path(merge_request.project, merge_request)
     end
@@ -20,7 +20,7 @@ describe 'Issue Sidebar on Mobile' do
     it_behaves_like "issue sidebar stays collapsed on mobile"
   end
 
-  context 'mobile sidebar on issues', js: true do
+  context 'mobile sidebar on issues', :js do
     before do
       visit project_issue_path(project, issue)
     end
diff --git a/spec/features/issues/award_emoji_spec.rb b/spec/features/issues/award_emoji_spec.rb
index a29acb30163..850b35c4467 100644
--- a/spec/features/issues/award_emoji_spec.rb
+++ b/spec/features/issues/award_emoji_spec.rb
@@ -24,7 +24,7 @@ describe 'Awards Emoji' do
       end
 
       # Regression test: https://gitlab.com/gitlab-org/gitlab-ce/issues/29529
-      it 'does not shows a 500 page', js: true do
+      it 'does not shows a 500 page', :js do
         expect(page).to have_text(issue.title)
       end
     end
@@ -37,37 +37,37 @@ describe 'Awards Emoji' do
         wait_for_requests
       end
 
-      it 'increments the thumbsdown emoji', js: true do
+      it 'increments the thumbsdown emoji', :js do
         find('[data-name="thumbsdown"]').click
         wait_for_requests
         expect(thumbsdown_emoji).to have_text("1")
       end
 
       context 'click the thumbsup emoji' do
-        it 'increments the thumbsup emoji', js: true do
+        it 'increments the thumbsup emoji', :js do
           find('[data-name="thumbsup"]').click
           wait_for_requests
           expect(thumbsup_emoji).to have_text("1")
         end
 
-        it 'decrements the thumbsdown emoji', js: true do
+        it 'decrements the thumbsdown emoji', :js do
           expect(thumbsdown_emoji).to have_text("0")
         end
       end
 
       context 'click the thumbsdown emoji' do
-        it 'increments the thumbsdown emoji', js: true do
+        it 'increments the thumbsdown emoji', :js do
           find('[data-name="thumbsdown"]').click
           wait_for_requests
           expect(thumbsdown_emoji).to have_text("1")
         end
 
-        it 'decrements the thumbsup emoji', js: true do
+        it 'decrements the thumbsup emoji', :js do
           expect(thumbsup_emoji).to have_text("0")
         end
       end
 
-      it 'toggles the smiley emoji on a note', js: true do
+      it 'toggles the smiley emoji on a note', :js do
         toggle_smiley_emoji(true)
 
         within('.note-body') do
@@ -82,7 +82,7 @@ describe 'Awards Emoji' do
       end
 
       context 'execute /award quick action' do
-        it 'toggles the emoji award on noteable', js: true do
+        it 'toggles the emoji award on noteable', :js do
           execute_quick_action('/award :100:')
 
           expect(find(noteable_award_counter)).to have_text("1")
@@ -95,7 +95,7 @@ describe 'Awards Emoji' do
     end
   end
 
-  context 'unauthorized user', js: true do
+  context 'unauthorized user', :js do
     before do
       visit project_issue_path(project, issue)
     end
diff --git a/spec/features/issues/award_spec.rb b/spec/features/issues/award_spec.rb
index e95eb19f7d1..ddb69d414da 100644
--- a/spec/features/issues/award_spec.rb
+++ b/spec/features/issues/award_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Issue awards', js: true do
+feature 'Issue awards', :js do
   let(:user)      { create(:user) }
   let(:project)   { create(:project, :public) }
   let(:issue)     { create(:issue, project: project) }
diff --git a/spec/features/issues/bulk_assignment_labels_spec.rb b/spec/features/issues/bulk_assignment_labels_spec.rb
index a89dcdf41dc..3223eb20b55 100644
--- a/spec/features/issues/bulk_assignment_labels_spec.rb
+++ b/spec/features/issues/bulk_assignment_labels_spec.rb
@@ -9,7 +9,7 @@ feature 'Issues > Labels bulk assignment' do
   let!(:feature)  { create(:label, project: project, title: 'feature') }
   let!(:wontfix)  { create(:label, project: project, title: 'wontfix') }
 
-  context 'as an allowed user', js: true do
+  context 'as an allowed user', :js do
     before do
       project.team << [user, :master]
 
diff --git a/spec/features/issues/create_issue_for_discussions_in_merge_request_spec.rb b/spec/features/issues/create_issue_for_discussions_in_merge_request_spec.rb
index 80cc8d22999..822ba48e005 100644
--- a/spec/features/issues/create_issue_for_discussions_in_merge_request_spec.rb
+++ b/spec/features/issues/create_issue_for_discussions_in_merge_request_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Resolving all open discussions in a merge request from an issue', js: true do
+feature 'Resolving all open discussions in a merge request from an issue', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository) }
   let(:merge_request) { create(:merge_request, source_project: project) }
diff --git a/spec/features/issues/create_issue_for_single_discussion_in_merge_request_spec.rb b/spec/features/issues/create_issue_for_single_discussion_in_merge_request_spec.rb
index ad5fd0fd97b..f0bed85595c 100644
--- a/spec/features/issues/create_issue_for_single_discussion_in_merge_request_spec.rb
+++ b/spec/features/issues/create_issue_for_single_discussion_in_merge_request_spec.rb
@@ -24,7 +24,7 @@ feature 'Resolve an open discussion in a merge request by creating an issue' do
       end
     end
 
-    context 'resolving the discussion', js: true do
+    context 'resolving the discussion', :js do
       before do
         click_button 'Resolve discussion'
       end
diff --git a/spec/features/issues/filtered_search/dropdown_author_spec.rb b/spec/features/issues/filtered_search/dropdown_author_spec.rb
index 3cec59050ab..5e20fb48768 100644
--- a/spec/features/issues/filtered_search/dropdown_author_spec.rb
+++ b/spec/features/issues/filtered_search/dropdown_author_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Dropdown author', js: true do
+describe 'Dropdown author', :js do
   include FilteredSearchHelpers
 
   let!(:project) { create(:project) }
diff --git a/spec/features/issues/filtered_search/dropdown_emoji_spec.rb b/spec/features/issues/filtered_search/dropdown_emoji_spec.rb
index 44741bcc92d..3012c77f2b9 100644
--- a/spec/features/issues/filtered_search/dropdown_emoji_spec.rb
+++ b/spec/features/issues/filtered_search/dropdown_emoji_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Dropdown emoji', js: true do
+describe 'Dropdown emoji', :js do
   include FilteredSearchHelpers
 
   let!(:project) { create(:project, :public) }
diff --git a/spec/features/issues/filtered_search/dropdown_label_spec.rb b/spec/features/issues/filtered_search/dropdown_label_spec.rb
index c46803112a9..cbc4f8d4c50 100644
--- a/spec/features/issues/filtered_search/dropdown_label_spec.rb
+++ b/spec/features/issues/filtered_search/dropdown_label_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Dropdown label', js: true do
+describe 'Dropdown label', :js do
   include FilteredSearchHelpers
 
   let(:project) { create(:project) }
diff --git a/spec/features/issues/filtered_search/filter_issues_spec.rb b/spec/features/issues/filtered_search/filter_issues_spec.rb
index 630d6a10c9c..2974016c6a7 100644
--- a/spec/features/issues/filtered_search/filter_issues_spec.rb
+++ b/spec/features/issues/filtered_search/filter_issues_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Filter issues', js: true do
+describe 'Filter issues', :js do
   include FilteredSearchHelpers
 
   let(:project) { create(:project) }
diff --git a/spec/features/issues/filtered_search/recent_searches_spec.rb b/spec/features/issues/filtered_search/recent_searches_spec.rb
index 447281ed19d..eef7988e2bd 100644
--- a/spec/features/issues/filtered_search/recent_searches_spec.rb
+++ b/spec/features/issues/filtered_search/recent_searches_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Recent searches', js: true do
+describe 'Recent searches', :js do
   include FilteredSearchHelpers
 
   let(:project_1) { create(:project, :public) }
diff --git a/spec/features/issues/filtered_search/search_bar_spec.rb b/spec/features/issues/filtered_search/search_bar_spec.rb
index d4dd570fb37..88688422dc7 100644
--- a/spec/features/issues/filtered_search/search_bar_spec.rb
+++ b/spec/features/issues/filtered_search/search_bar_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Search bar', js: true do
+describe 'Search bar', :js do
   include FilteredSearchHelpers
 
   let!(:project) { create(:project) }
diff --git a/spec/features/issues/filtered_search/visual_tokens_spec.rb b/spec/features/issues/filtered_search/visual_tokens_spec.rb
index 2b624f4842d..920f5546eef 100644
--- a/spec/features/issues/filtered_search/visual_tokens_spec.rb
+++ b/spec/features/issues/filtered_search/visual_tokens_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'Visual tokens', js: true do
+describe 'Visual tokens', :js do
   include FilteredSearchHelpers
   include WaitForRequests
 
diff --git a/spec/features/issues/gfm_autocomplete_spec.rb b/spec/features/issues/gfm_autocomplete_spec.rb
index c6cf6265645..15041ff04ea 100644
--- a/spec/features/issues/gfm_autocomplete_spec.rb
+++ b/spec/features/issues/gfm_autocomplete_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'GFM autocomplete', js: true do
+feature 'GFM autocomplete', :js do
   let(:user)    { create(:user, name: '💃speciąl someone💃', username: 'someone.special') }
   let(:project) { create(:project) }
   let(:label) { create(:label, project: project, title: 'special+') }
diff --git a/spec/features/issues/issue_sidebar_spec.rb b/spec/features/issues/issue_sidebar_spec.rb
index af11b474842..bc9c3d825c1 100644
--- a/spec/features/issues/issue_sidebar_spec.rb
+++ b/spec/features/issues/issue_sidebar_spec.rb
@@ -13,7 +13,7 @@ feature 'Issue Sidebar' do
     sign_in(user)
   end
 
-  context 'assignee', js: true do
+  context 'assignee', :js do
     let(:user2) { create(:user) }
     let(:issue2) { create(:issue, project: project, author: user2) }
 
@@ -82,7 +82,7 @@ feature 'Issue Sidebar' do
       visit_issue(project, issue)
     end
 
-    context 'sidebar', js: true do
+    context 'sidebar', :js do
       it 'changes size when the screen size is smaller' do
         sidebar_selector = 'aside.right-sidebar.right-sidebar-collapsed'
         # Resize the window
@@ -101,7 +101,7 @@ feature 'Issue Sidebar' do
       end
     end
 
-    context 'editing issue labels', js: true do
+    context 'editing issue labels', :js do
       before do
         page.within('.block.labels') do
           find('.edit-link').click
@@ -114,7 +114,7 @@ feature 'Issue Sidebar' do
         end
       end
 
-      context 'creating a new label', js: true do
+      context 'creating a new label', :js do
         before do
           page.within('.block.labels') do
             click_link 'Create new'
diff --git a/spec/features/issues/markdown_toolbar_spec.rb b/spec/features/issues/markdown_toolbar_spec.rb
index 634ea111dc1..6869c2c869d 100644
--- a/spec/features/issues/markdown_toolbar_spec.rb
+++ b/spec/features/issues/markdown_toolbar_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Issue markdown toolbar', js: true do
+feature 'Issue markdown toolbar', :js do
   let(:project) { create(:project, :public) }
   let(:issue)   { create(:issue, project: project) }
   let(:user)    { create(:user) }
diff --git a/spec/features/issues/move_spec.rb b/spec/features/issues/move_spec.rb
index b2724945da4..6d7b1b1cd8f 100644
--- a/spec/features/issues/move_spec.rb
+++ b/spec/features/issues/move_spec.rb
@@ -37,7 +37,7 @@ feature 'issue move to another project' do
       visit issue_path(issue)
     end
 
-    scenario 'moving issue to another project', js: true do
+    scenario 'moving issue to another project', :js do
       find('.js-move-issue').trigger('click')
       wait_for_requests
       all('.js-move-issue-dropdown-item')[0].click
@@ -49,7 +49,7 @@ feature 'issue move to another project' do
       expect(page.current_path).to include project_path(new_project)
     end
 
-    scenario 'searching project dropdown', js: true do
+    scenario 'searching project dropdown', :js do
       new_project_search.team << [user, :reporter]
 
       find('.js-move-issue').trigger('click')
@@ -63,7 +63,7 @@ feature 'issue move to another project' do
       end
     end
 
-    context 'user does not have permission to move the issue to a project', js: true do
+    context 'user does not have permission to move the issue to a project', :js do
       let!(:private_project) { create(:project, :private) }
       let(:another_project) { create(:project) }
       background { another_project.team << [user, :guest] }
diff --git a/spec/features/issues/spam_issues_spec.rb b/spec/features/issues/spam_issues_spec.rb
index 332ce78b138..d25231d624c 100644
--- a/spec/features/issues/spam_issues_spec.rb
+++ b/spec/features/issues/spam_issues_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-describe 'New issue', js: true do
+describe 'New issue', :js do
   include StubENV
 
   let(:project) { create(:project, :public) }
diff --git a/spec/features/issues/todo_spec.rb b/spec/features/issues/todo_spec.rb
index 8405f1cd48d..29a2d38ae18 100644
--- a/spec/features/issues/todo_spec.rb
+++ b/spec/features/issues/todo_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Manually create a todo item from issue', js: true do
+feature 'Manually create a todo item from issue', :js do
   let!(:project) { create(:project) }
   let!(:issue)   { create(:issue, project: project) }
   let!(:user)    { create(:user)}
diff --git a/spec/features/issues/user_uses_slash_commands_spec.rb b/spec/features/issues/user_uses_slash_commands_spec.rb
index 7437c469a72..9f5e25ff2cb 100644
--- a/spec/features/issues/user_uses_slash_commands_spec.rb
+++ b/spec/features/issues/user_uses_slash_commands_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Issues > User uses quick actions', js: true do
+feature 'Issues > User uses quick actions', :js do
   include QuickActionsHelpers
 
   it_behaves_like 'issuable record that supports quick actions in its description and notes', :issue do
diff --git a/spec/features/issues_spec.rb b/spec/features/issues_spec.rb
index e2db1442d90..25e99774575 100644
--- a/spec/features/issues_spec.rb
+++ b/spec/features/issues_spec.rb
@@ -270,7 +270,7 @@ describe 'Issues', :js do
       visit namespace_project_issues_path(user.namespace, project1)
     end
 
-    it 'changes incoming email address token', js: true do
+    it 'changes incoming email address token', :js do
       find('.issue-email-modal-btn').click
       previous_token = find('input#issue_email').value
       find('.incoming-email-token-reset').trigger('click')
@@ -286,7 +286,7 @@ describe 'Issues', :js do
     end
   end
 
-  describe 'update labels from issue#show', js: true do
+  describe 'update labels from issue#show', :js do
     let(:issue) { create(:issue, project: project, author: user, assignees: [user]) }
     let!(:label) { create(:label, project: project) }
 
@@ -309,7 +309,7 @@ describe 'Issues', :js do
     let(:issue) { create(:issue, project: project, author: user, assignees: [user]) }
 
     context 'by authorized user' do
-      it 'allows user to select unassigned', js: true do
+      it 'allows user to select unassigned', :js do
         visit project_issue_path(project, issue)
 
         page.within('.assignee') do
@@ -327,7 +327,7 @@ describe 'Issues', :js do
         expect(issue.reload.assignees).to be_empty
       end
 
-      it 'allows user to select an assignee', js: true do
+      it 'allows user to select an assignee', :js do
         issue2 = create(:issue, project: project, author: user)
         visit project_issue_path(project, issue2)
 
@@ -348,7 +348,7 @@ describe 'Issues', :js do
         end
       end
 
-      it 'allows user to unselect themselves', js: true do
+      it 'allows user to unselect themselves', :js do
         issue2 = create(:issue, project: project, author: user)
         visit project_issue_path(project, issue2)
 
@@ -377,7 +377,7 @@ describe 'Issues', :js do
         project.team << [[guest], :guest]
       end
 
-      it 'shows assignee text', js: true do
+      it 'shows assignee text', :js do
         sign_out(:user)
         sign_in(guest)
 
@@ -392,7 +392,7 @@ describe 'Issues', :js do
     let!(:milestone) { create(:milestone, project: project) }
 
     context 'by authorized user' do
-      it 'allows user to select unassigned', js: true do
+      it 'allows user to select unassigned', :js do
         visit project_issue_path(project, issue)
 
         page.within('.milestone') do
@@ -410,7 +410,7 @@ describe 'Issues', :js do
         expect(issue.reload.milestone).to be_nil
       end
 
-      it 'allows user to de-select milestone', js: true do
+      it 'allows user to de-select milestone', :js do
         visit project_issue_path(project, issue)
 
         page.within('.milestone') do
@@ -440,7 +440,7 @@ describe 'Issues', :js do
         issue.save
       end
 
-      it 'shows milestone text', js: true do
+      it 'shows milestone text', :js do
         sign_out(:user)
         sign_in(guest)
 
@@ -473,7 +473,7 @@ describe 'Issues', :js do
       end
     end
 
-    context 'dropzone upload file', js: true do
+    context 'dropzone upload file', :js do
       before do
         visit new_project_issue_path(project)
       end
@@ -544,7 +544,7 @@ describe 'Issues', :js do
   end
 
   describe 'due date' do
-    context 'update due on issue#show', js: true do
+    context 'update due on issue#show', :js do
       let(:issue) { create(:issue, project: project, author: user, assignees: [user]) }
 
       before do
@@ -588,8 +588,8 @@ describe 'Issues', :js do
     end
   end
 
-  describe 'title issue#show', js: true do
-    it 'updates the title', js: true do
+  describe 'title issue#show', :js do
+    it 'updates the title', :js do
       issue = create(:issue, author: user, assignees: [user], project: project, title: 'new title')
 
       visit project_issue_path(project, issue)
@@ -603,7 +603,7 @@ describe 'Issues', :js do
     end
   end
 
-  describe 'confidential issue#show', js: true do
+  describe 'confidential issue#show', :js do
     it 'shows confidential sibebar information as confidential and can be turned off' do
       issue = create(:issue, :confidential, project: project)
 
diff --git a/spec/features/login_spec.rb b/spec/features/login_spec.rb
index c9983f0941f..6dfabcc7225 100644
--- a/spec/features/login_spec.rb
+++ b/spec/features/login_spec.rb
@@ -197,7 +197,7 @@ feature 'Login' do
             expect(page).to have_content('The global settings require you to enable Two-Factor Authentication for your account. You need to do this before ')
           end
 
-          it 'allows skipping two-factor configuration', js: true do
+          it 'allows skipping two-factor configuration', :js do
             expect(current_path).to eq profile_two_factor_auth_path
 
             click_link 'Configure it later'
@@ -215,7 +215,7 @@ feature 'Login' do
             )
           end
 
-          it 'disallows skipping two-factor configuration', js: true do
+          it 'disallows skipping two-factor configuration', :js do
             expect(current_path).to eq profile_two_factor_auth_path
             expect(page).not_to have_link('Configure it later')
           end
@@ -260,7 +260,7 @@ feature 'Login' do
               'before ')
           end
 
-          it 'allows skipping two-factor configuration', js: true do
+          it 'allows skipping two-factor configuration', :js do
             expect(current_path).to eq profile_two_factor_auth_path
 
             click_link 'Configure it later'
@@ -279,7 +279,7 @@ feature 'Login' do
             )
           end
 
-          it 'disallows skipping two-factor configuration', js: true do
+          it 'disallows skipping two-factor configuration', :js do
             expect(current_path).to eq profile_two_factor_auth_path
             expect(page).not_to have_link('Configure it later')
           end
diff --git a/spec/features/merge_requests/assign_issues_spec.rb b/spec/features/merge_requests/assign_issues_spec.rb
index 63fa72650ac..d49d145f254 100644
--- a/spec/features/merge_requests/assign_issues_spec.rb
+++ b/spec/features/merge_requests/assign_issues_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Merge request issue assignment', js: true do
+feature 'Merge request issue assignment', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
   let(:issue1) { create(:issue, project: project) }
diff --git a/spec/features/merge_requests/award_spec.rb b/spec/features/merge_requests/award_spec.rb
index e886309133d..a24464f2556 100644
--- a/spec/features/merge_requests/award_spec.rb
+++ b/spec/features/merge_requests/award_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Merge request awards', js: true do
+feature 'Merge request awards', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
   let(:merge_request) { create(:merge_request, source_project: project) }
diff --git a/spec/features/merge_requests/check_if_mergeable_with_unresolved_discussions_spec.rb b/spec/features/merge_requests/check_if_mergeable_with_unresolved_discussions_spec.rb
index 1f5e7b55fb0..fbbfe7942be 100644
--- a/spec/features/merge_requests/check_if_mergeable_with_unresolved_discussions_spec.rb
+++ b/spec/features/merge_requests/check_if_mergeable_with_unresolved_discussions_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Check if mergeable with unresolved discussions', js: true do
+feature 'Check if mergeable with unresolved discussions', :js do
   let(:user)           { create(:user) }
   let(:project)        { create(:project, :repository) }
   let!(:merge_request) { create(:merge_request_with_diff_notes, source_project: project, author: user) }
diff --git a/spec/features/merge_requests/cherry_pick_spec.rb b/spec/features/merge_requests/cherry_pick_spec.rb
index 4b1e1b9a8d4..48f370c3ad4 100644
--- a/spec/features/merge_requests/cherry_pick_spec.rb
+++ b/spec/features/merge_requests/cherry_pick_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Cherry-pick Merge Requests', js: true do
+describe 'Cherry-pick Merge Requests', :js do
   let(:user) { create(:user) }
   let(:group) { create(:group) }
   let(:project) { create(:project, :repository, namespace: group) }
diff --git a/spec/features/merge_requests/closes_issues_spec.rb b/spec/features/merge_requests/closes_issues_spec.rb
index 299b4f5708a..4dd4e40f52c 100644
--- a/spec/features/merge_requests/closes_issues_spec.rb
+++ b/spec/features/merge_requests/closes_issues_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Merge Request closing issues message', js: true do
+feature 'Merge Request closing issues message', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
   let(:issue_1) { create(:issue, project: project)}
diff --git a/spec/features/merge_requests/conflicts_spec.rb b/spec/features/merge_requests/conflicts_spec.rb
index 2d2c674f8fb..b0432ed8fc6 100644
--- a/spec/features/merge_requests/conflicts_spec.rb
+++ b/spec/features/merge_requests/conflicts_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Merge request conflict resolution', js: true do
+feature 'Merge request conflict resolution', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository) }
 
diff --git a/spec/features/merge_requests/create_new_mr_spec.rb b/spec/features/merge_requests/create_new_mr_spec.rb
index 96e8027a54d..5402d61da54 100644
--- a/spec/features/merge_requests/create_new_mr_spec.rb
+++ b/spec/features/merge_requests/create_new_mr_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Create New Merge Request', js: true do
+feature 'Create New Merge Request', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
 
diff --git a/spec/features/merge_requests/created_from_fork_spec.rb b/spec/features/merge_requests/created_from_fork_spec.rb
index f9bc3ee6c58..d03ddfece74 100644
--- a/spec/features/merge_requests/created_from_fork_spec.rb
+++ b/spec/features/merge_requests/created_from_fork_spec.rb
@@ -34,7 +34,7 @@ feature 'Merge request created from fork' do
                               commit_id: merge_request.commit_shas.first)
     end
 
-    scenario 'user can reply to the comment', js: true do
+    scenario 'user can reply to the comment', :js do
       visit_merge_request(merge_request)
 
       expect(page).to have_content(comment)
@@ -57,7 +57,7 @@ feature 'Merge request created from fork' do
       forked_project.destroy!
     end
 
-    scenario 'user can access merge request', js: true do
+    scenario 'user can access merge request', :js do
       visit_merge_request(merge_request)
 
       expect(page).to have_content 'Test merge request'
@@ -78,7 +78,7 @@ feature 'Merge request created from fork' do
       create(:ci_build, pipeline: pipeline, name: 'spinach')
     end
 
-    scenario 'user visits a pipelines page', js: true do
+    scenario 'user visits a pipelines page', :js do
       visit_merge_request(merge_request)
       page.within('.merge-request-tabs') { click_link 'Pipelines' }
 
diff --git a/spec/features/merge_requests/deleted_source_branch_spec.rb b/spec/features/merge_requests/deleted_source_branch_spec.rb
index 874c6e2ff69..7f69e82af4c 100644
--- a/spec/features/merge_requests/deleted_source_branch_spec.rb
+++ b/spec/features/merge_requests/deleted_source_branch_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 # This test serves as a regression test for a bug that caused an error
 # message to be shown by JavaScript when the source branch was deleted.
 # Please do not remove "js: true".
-describe 'Deleted source branch', js: true do
+describe 'Deleted source branch', :js do
   let(:user) { create(:user) }
   let(:merge_request) { create(:merge_request) }
 
diff --git a/spec/features/merge_requests/diff_notes_avatars_spec.rb b/spec/features/merge_requests/diff_notes_avatars_spec.rb
index 4766cdf716f..9aa0672feae 100644
--- a/spec/features/merge_requests/diff_notes_avatars_spec.rb
+++ b/spec/features/merge_requests/diff_notes_avatars_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Diff note avatars', js: true do
+feature 'Diff note avatars', :js do
   include NoteInteractionHelpers
 
   let(:user)          { create(:user) }
diff --git a/spec/features/merge_requests/diff_notes_resolve_spec.rb b/spec/features/merge_requests/diff_notes_resolve_spec.rb
index fd110e68e84..637e6036384 100644
--- a/spec/features/merge_requests/diff_notes_resolve_spec.rb
+++ b/spec/features/merge_requests/diff_notes_resolve_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Diff notes resolve', js: true do
+feature 'Diff notes resolve', :js do
   let(:user)          { create(:user) }
   let(:project)       { create(:project, :public, :repository) }
   let(:merge_request) { create(:merge_request_with_diffs, source_project: project, author: user, title: "Bug NS-04") }
diff --git a/spec/features/merge_requests/diffs_spec.rb b/spec/features/merge_requests/diffs_spec.rb
index ee9bb50a881..80fb7335989 100644
--- a/spec/features/merge_requests/diffs_spec.rb
+++ b/spec/features/merge_requests/diffs_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Diffs URL', js: true do
+feature 'Diffs URL', :js do
   include ProjectForksHelper
 
   let(:project) { create(:project, :public, :repository) }
diff --git a/spec/features/merge_requests/edit_mr_spec.rb b/spec/features/merge_requests/edit_mr_spec.rb
index 7386e78fb13..4538555c168 100644
--- a/spec/features/merge_requests/edit_mr_spec.rb
+++ b/spec/features/merge_requests/edit_mr_spec.rb
@@ -29,7 +29,7 @@ feature 'Edit Merge Request' do
       expect(page).to have_content 'Someone edited the merge request the same time you did'
     end
 
-    it 'allows to unselect "Remove source branch"', js: true do
+    it 'allows to unselect "Remove source branch"', :js do
       merge_request.update(merge_params: { 'force_remove_source_branch' => '1' })
       expect(merge_request.merge_params['force_remove_source_branch']).to be_truthy
 
@@ -42,7 +42,7 @@ feature 'Edit Merge Request' do
       expect(page).to have_content 'Remove source branch'
     end
 
-    it 'should preserve description textarea height', js: true do
+    it 'should preserve description textarea height', :js do
       long_description = %q(
         Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam ac ornare ligula, ut tempus arcu. Etiam ultricies accumsan dolor vitae faucibus. Donec at elit lacus. Mauris orci ante, aliquam quis lorem eget, convallis faucibus arcu. Aenean at pulvinar lacus. Ut viverra quam massa, molestie ornare tortor dignissim a. Suspendisse tristique pellentesque tellus, id lacinia metus elementum id. Nam tristique, arcu rhoncus faucibus viverra, lacus ipsum sagittis ligula, vitae convallis odio lacus a nibh. Ut tincidunt est purus, ac vestibulum augue maximus in. Suspendisse vel erat et mi ultricies semper. Pellentesque volutpat pellentesque consequat.
 
diff --git a/spec/features/merge_requests/filter_by_milestone_spec.rb b/spec/features/merge_requests/filter_by_milestone_spec.rb
index 166c02a7a7f..8b9ff9be943 100644
--- a/spec/features/merge_requests/filter_by_milestone_spec.rb
+++ b/spec/features/merge_requests/filter_by_milestone_spec.rb
@@ -18,7 +18,7 @@ feature 'Merge Request filtering by Milestone' do
     sign_in(user)
   end
 
-  scenario 'filters by no Milestone', js: true do
+  scenario 'filters by no Milestone', :js do
     create(:merge_request, :with_diffs, source_project: project)
     create(:merge_request, :simple, source_project: project, milestone: milestone)
 
@@ -32,7 +32,7 @@ feature 'Merge Request filtering by Milestone' do
     expect(page).to have_css('.merge-request', count: 1)
   end
 
-  context 'filters by upcoming milestone', js: true do
+  context 'filters by upcoming milestone', :js do
     it 'does not show merge requests with no expiry' do
       create(:merge_request, :with_diffs, source_project: project)
       create(:merge_request, :simple, source_project: project, milestone: milestone)
@@ -67,7 +67,7 @@ feature 'Merge Request filtering by Milestone' do
     end
   end
 
-  scenario 'filters by a specific Milestone', js: true do
+  scenario 'filters by a specific Milestone', :js do
     create(:merge_request, :with_diffs, source_project: project, milestone: milestone)
     create(:merge_request, :simple, source_project: project)
 
@@ -83,7 +83,7 @@ feature 'Merge Request filtering by Milestone' do
       milestone.update(name: "rock 'n' roll")
     end
 
-    scenario 'filters by a specific Milestone', js: true do
+    scenario 'filters by a specific Milestone', :js do
       create(:merge_request, :with_diffs, source_project: project, milestone: milestone)
       create(:merge_request, :simple, source_project: project)
 
diff --git a/spec/features/merge_requests/filter_merge_requests_spec.rb b/spec/features/merge_requests/filter_merge_requests_spec.rb
index 16703bc1c01..aac295ab940 100644
--- a/spec/features/merge_requests/filter_merge_requests_spec.rb
+++ b/spec/features/merge_requests/filter_merge_requests_spec.rb
@@ -36,7 +36,7 @@ describe 'Filter merge requests' do
       expect_mr_list_count(0)
     end
 
-    context 'assignee', js: true do
+    context 'assignee', :js do
       it 'updates to current user' do
         expect_assignee_visual_tokens()
       end
@@ -69,7 +69,7 @@ describe 'Filter merge requests' do
       expect_mr_list_count(0)
     end
 
-    context 'milestone', js: true do
+    context 'milestone', :js do
       it 'updates to current milestone' do
         expect_milestone_visual_tokens()
       end
@@ -88,7 +88,7 @@ describe 'Filter merge requests' do
     end
   end
 
-  describe 'for label from mr#index', js: true do
+  describe 'for label from mr#index', :js do
     it 'filters by no label' do
       input_filtered_search('label:none')
 
@@ -137,7 +137,7 @@ describe 'Filter merge requests' do
       expect_mr_list_count(0)
     end
 
-    context 'assignee and label', js: true do
+    context 'assignee and label', :js do
       def expect_assignee_label_visual_tokens
         wait_for_requests
 
@@ -183,7 +183,7 @@ describe 'Filter merge requests' do
       visit project_merge_requests_path(project)
     end
 
-    context 'only text', js: true do
+    context 'only text', :js do
       it 'filters merge requests by searched text' do
         input_filtered_search('bug')
 
@@ -199,7 +199,7 @@ describe 'Filter merge requests' do
       end
     end
 
-    context 'filters and searches', js: true do
+    context 'filters and searches', :js do
       it 'filters by text and label' do
         input_filtered_search('Bug')
 
@@ -289,7 +289,7 @@ describe 'Filter merge requests' do
     end
   end
 
-  describe 'filter by assignee id', js: true do
+  describe 'filter by assignee id', :js do
     it 'filter by current user' do
       visit project_merge_requests_path(project, assignee_id: user.id)
 
@@ -312,7 +312,7 @@ describe 'Filter merge requests' do
     end
   end
 
-  describe 'filter by author id', js: true do
+  describe 'filter by author id', :js do
     it 'filter by current user' do
       visit project_merge_requests_path(project, author_id: user.id)
 
diff --git a/spec/features/merge_requests/image_diff_notes.rb b/spec/features/merge_requests/image_diff_notes.rb
index e8ca8a98d70..3c53b51e330 100644
--- a/spec/features/merge_requests/image_diff_notes.rb
+++ b/spec/features/merge_requests/image_diff_notes.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'image diff notes', js: true do
+feature 'image diff notes', :js do
   include NoteInteractionHelpers
 
   let(:user) { create(:user) }
diff --git a/spec/features/merge_requests/merge_commit_message_toggle_spec.rb b/spec/features/merge_requests/merge_commit_message_toggle_spec.rb
index 08a3bb84aac..82b2b56ef80 100644
--- a/spec/features/merge_requests/merge_commit_message_toggle_spec.rb
+++ b/spec/features/merge_requests/merge_commit_message_toggle_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Clicking toggle commit message link', js: true do
+feature 'Clicking toggle commit message link', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public, :repository) }
   let(:issue_1) { create(:issue, project: project)}
diff --git a/spec/features/merge_requests/only_allow_merge_if_build_succeeds_spec.rb b/spec/features/merge_requests/only_allow_merge_if_build_succeeds_spec.rb
index 59e67420333..91f207bd339 100644
--- a/spec/features/merge_requests/only_allow_merge_if_build_succeeds_spec.rb
+++ b/spec/features/merge_requests/only_allow_merge_if_build_succeeds_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Only allow merge requests to be merged if the pipeline succeeds', js: true do
+feature 'Only allow merge requests to be merged if the pipeline succeeds', :js do
   let(:merge_request) { create(:merge_request_with_diffs) }
   let(:project)       { merge_request.target_project }
 
@@ -10,7 +10,7 @@ feature 'Only allow merge requests to be merged if the pipeline succeeds', js: t
     project.team << [merge_request.author, :master]
   end
 
-  context 'project does not have CI enabled', js: true do
+  context 'project does not have CI enabled', :js do
     it 'allows MR to be merged' do
       visit_merge_request(merge_request)
 
@@ -20,7 +20,7 @@ feature 'Only allow merge requests to be merged if the pipeline succeeds', js: t
     end
   end
 
-  context 'when project has CI enabled', js: true do
+  context 'when project has CI enabled', :js do
     given!(:pipeline) do
       create(:ci_empty_pipeline,
       project: project,
diff --git a/spec/features/merge_requests/pipelines_spec.rb b/spec/features/merge_requests/pipelines_spec.rb
index 347ce788b36..a3fcc27cab0 100644
--- a/spec/features/merge_requests/pipelines_spec.rb
+++ b/spec/features/merge_requests/pipelines_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Pipelines for Merge Requests', js: true do
+feature 'Pipelines for Merge Requests', :js do
   describe 'pipeline tab' do
     given(:user) { create(:user) }
     given(:merge_request) { create(:merge_request) }
diff --git a/spec/features/merge_requests/resolve_outdated_diff_discussions.rb b/spec/features/merge_requests/resolve_outdated_diff_discussions.rb
index 55a82bdf2b9..25abbb469ab 100644
--- a/spec/features/merge_requests/resolve_outdated_diff_discussions.rb
+++ b/spec/features/merge_requests/resolve_outdated_diff_discussions.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Resolve outdated diff discussions', js: true do
+feature 'Resolve outdated diff discussions', :js do
   let(:project) { create(:project, :repository, :public) }
 
   let(:merge_request) do
diff --git a/spec/features/merge_requests/target_branch_spec.rb b/spec/features/merge_requests/target_branch_spec.rb
index 9bbf2610bcb..bce36e05e57 100644
--- a/spec/features/merge_requests/target_branch_spec.rb
+++ b/spec/features/merge_requests/target_branch_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Target branch', js: true do
+describe 'Target branch', :js do
   let(:user) { create(:user) }
   let(:merge_request) { create(:merge_request) }
   let(:project) { merge_request.project }
diff --git a/spec/features/merge_requests/toggle_whitespace_changes_spec.rb b/spec/features/merge_requests/toggle_whitespace_changes_spec.rb
index dd989fd49b2..fa3d988b27a 100644
--- a/spec/features/merge_requests/toggle_whitespace_changes_spec.rb
+++ b/spec/features/merge_requests/toggle_whitespace_changes_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Toggle Whitespace Changes', js: true do
+feature 'Toggle Whitespace Changes', :js do
   before do
     sign_in(create(:admin))
     merge_request = create(:merge_request)
diff --git a/spec/features/merge_requests/toggler_behavior_spec.rb b/spec/features/merge_requests/toggler_behavior_spec.rb
index 4e5ec9fbd2d..cd92ad22267 100644
--- a/spec/features/merge_requests/toggler_behavior_spec.rb
+++ b/spec/features/merge_requests/toggler_behavior_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'toggler_behavior', js: true do
+feature 'toggler_behavior', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository) }
   let(:merge_request) { create(:merge_request, source_project: project, author: user) }
diff --git a/spec/features/merge_requests/update_merge_requests_spec.rb b/spec/features/merge_requests/update_merge_requests_spec.rb
index 9cb8a357309..1a41fd36a4f 100644
--- a/spec/features/merge_requests/update_merge_requests_spec.rb
+++ b/spec/features/merge_requests/update_merge_requests_spec.rb
@@ -10,7 +10,7 @@ feature 'Multiple merge requests updating from merge_requests#index' do
     sign_in(user)
   end
 
-  context 'status', js: true do
+  context 'status', :js do
     describe 'close merge request' do
       before do
         visit project_merge_requests_path(project)
@@ -37,7 +37,7 @@ feature 'Multiple merge requests updating from merge_requests#index' do
     end
   end
 
-  context 'assignee', js: true do
+  context 'assignee', :js do
     describe 'set assignee' do
       before do
         visit project_merge_requests_path(project)
@@ -67,7 +67,7 @@ feature 'Multiple merge requests updating from merge_requests#index' do
     end
   end
 
-  context 'milestone', js: true do
+  context 'milestone', :js do
     let(:milestone)  { create(:milestone, project: project) }
 
     describe 'set milestone' do
diff --git a/spec/features/merge_requests/user_uses_slash_commands_spec.rb b/spec/features/merge_requests/user_uses_slash_commands_spec.rb
index 95c50df1896..ee0766f1192 100644
--- a/spec/features/merge_requests/user_uses_slash_commands_spec.rb
+++ b/spec/features/merge_requests/user_uses_slash_commands_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Merge Requests > User uses quick actions', js: true do
+feature 'Merge Requests > User uses quick actions', :js do
   include QuickActionsHelpers
 
   it_behaves_like 'issuable record that supports quick actions in its description and notes', :merge_request do
diff --git a/spec/features/merge_requests/versions_spec.rb b/spec/features/merge_requests/versions_spec.rb
index 8e231fbc281..50f7d721ff3 100644
--- a/spec/features/merge_requests/versions_spec.rb
+++ b/spec/features/merge_requests/versions_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Merge Request versions', js: true do
+feature 'Merge Request versions', :js do
   let(:merge_request) { create(:merge_request, importing: true) }
   let(:project) { merge_request.source_project }
   let!(:merge_request_diff1) { merge_request.merge_request_diffs.create(head_commit_sha: '6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9') }
diff --git a/spec/features/merge_requests/widget_deployments_spec.rb b/spec/features/merge_requests/widget_deployments_spec.rb
index c0221525c9f..5658c2c5122 100644
--- a/spec/features/merge_requests/widget_deployments_spec.rb
+++ b/spec/features/merge_requests/widget_deployments_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Widget Deployments Header', js: true do
+feature 'Widget Deployments Header', :js do
   describe 'when deployed to an environment' do
     given(:user) { create(:user) }
     given(:project) { merge_request.target_project }
diff --git a/spec/features/merge_requests/widget_spec.rb b/spec/features/merge_requests/widget_spec.rb
index ab1353e3369..2bad3b02250 100644
--- a/spec/features/merge_requests/widget_spec.rb
+++ b/spec/features/merge_requests/widget_spec.rb
@@ -256,7 +256,7 @@ describe 'Merge request', :js do
     end
   end
 
-  context 'user can merge into source project but cannot push to fork', js: true do
+  context 'user can merge into source project but cannot push to fork', :js do
     let(:fork_project) { create(:project, :public, :repository) }
     let(:user2) { create(:user) }
 
diff --git a/spec/features/profiles/keys_spec.rb b/spec/features/profiles/keys_spec.rb
index aa71c4dbba4..7d5ba3a7328 100644
--- a/spec/features/profiles/keys_spec.rb
+++ b/spec/features/profiles/keys_spec.rb
@@ -12,7 +12,7 @@ feature 'Profile > SSH Keys' do
       visit profile_keys_path
     end
 
-    scenario 'auto-populates the title', js: true do
+    scenario 'auto-populates the title', :js do
       fill_in('Key', with: attributes_for(:key).fetch(:key))
 
       expect(page).to have_field("Title", with: "dummy@gitlab.com")
diff --git a/spec/features/profiles/oauth_applications_spec.rb b/spec/features/profiles/oauth_applications_spec.rb
index 45f78444362..8cb240077eb 100644
--- a/spec/features/profiles/oauth_applications_spec.rb
+++ b/spec/features/profiles/oauth_applications_spec.rb
@@ -7,7 +7,7 @@ describe 'Profile > Applications' do
     sign_in(user)
   end
 
-  describe 'User manages applications', js: true do
+  describe 'User manages applications', :js do
     it 'deletes an application' do
       create(:oauth_application, owner: user)
       visit oauth_applications_path
diff --git a/spec/features/profiles/personal_access_tokens_spec.rb b/spec/features/profiles/personal_access_tokens_spec.rb
index f3124bbf29e..a572160dae9 100644
--- a/spec/features/profiles/personal_access_tokens_spec.rb
+++ b/spec/features/profiles/personal_access_tokens_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Profile > Personal Access Tokens', js: true do
+describe 'Profile > Personal Access Tokens', :js do
   let(:user) { create(:user) }
 
   def active_personal_access_tokens
diff --git a/spec/features/profiles/user_changes_notified_of_own_activity_spec.rb b/spec/features/profiles/user_changes_notified_of_own_activity_spec.rb
index 6a4173d43e1..d5fe5bdffc5 100644
--- a/spec/features/profiles/user_changes_notified_of_own_activity_spec.rb
+++ b/spec/features/profiles/user_changes_notified_of_own_activity_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Profile > Notifications > User changes notified_of_own_activity setting', js: true do
+feature 'Profile > Notifications > User changes notified_of_own_activity setting', :js do
   let(:user) { create(:user) }
 
   before do
diff --git a/spec/features/profiles/user_visits_notifications_tab_spec.rb b/spec/features/profiles/user_visits_notifications_tab_spec.rb
index 48c1787c8b7..923ca8b1c80 100644
--- a/spec/features/profiles/user_visits_notifications_tab_spec.rb
+++ b/spec/features/profiles/user_visits_notifications_tab_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'User visits the notifications tab', js: true do
+feature 'User visits the notifications tab', :js do
   let(:project) { create(:project) }
   let(:user) { create(:user) }
 
diff --git a/spec/features/projects/badges/list_spec.rb b/spec/features/projects/badges/list_spec.rb
index 89ae891037e..68c4a647958 100644
--- a/spec/features/projects/badges/list_spec.rb
+++ b/spec/features/projects/badges/list_spec.rb
@@ -39,7 +39,7 @@ feature 'list of badges' do
     end
   end
 
-  scenario 'user changes current ref of build status badge', js: true do
+  scenario 'user changes current ref of build status badge', :js do
     page.within('.pipeline-status') do
       first('.js-project-refs-dropdown').click
 
diff --git a/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb b/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
index 1160f674974..c12e56d2c3f 100644
--- a/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
+++ b/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Blob button line permalinks (BlobLinePermalinkUpdater)', js: true do
+feature 'Blob button line permalinks (BlobLinePermalinkUpdater)', :js do
   include TreeHelper
 
   let(:project) { create(:project, :public, :repository) }
diff --git a/spec/features/projects/blobs/edit_spec.rb b/spec/features/projects/blobs/edit_spec.rb
index 62ac9fd0e95..6c625ed17aa 100644
--- a/spec/features/projects/blobs/edit_spec.rb
+++ b/spec/features/projects/blobs/edit_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Editing file blob', js: true do
+feature 'Editing file blob', :js do
   include TreeHelper
 
   let(:project) { create(:project, :public, :repository) }
diff --git a/spec/features/projects/blobs/shortcuts_blob_spec.rb b/spec/features/projects/blobs/shortcuts_blob_spec.rb
index 1e3080fa319..9f1fef80ab5 100644
--- a/spec/features/projects/blobs/shortcuts_blob_spec.rb
+++ b/spec/features/projects/blobs/shortcuts_blob_spec.rb
@@ -6,7 +6,7 @@ feature 'Blob shortcuts' do
   let(:path) { project.repository.ls_files(project.repository.root_ref)[0] }
   let(:sha) { project.repository.commit.sha }
 
-  describe 'On a file(blob)', js: true do
+  describe 'On a file(blob)', :js do
     def get_absolute_url(path = "")
       "http://#{page.server.host}:#{page.server.port}#{path}"
     end
diff --git a/spec/features/projects/branches_spec.rb b/spec/features/projects/branches_spec.rb
index d1f5623554d..941d34dd660 100644
--- a/spec/features/projects/branches_spec.rb
+++ b/spec/features/projects/branches_spec.rb
@@ -46,7 +46,7 @@ describe 'Branches' do
     end
 
     describe 'Find branches' do
-      it 'shows filtered branches', js: true do
+      it 'shows filtered branches', :js do
         visit project_branches_path(project)
 
         fill_in 'branch-search', with: 'fix'
@@ -58,7 +58,7 @@ describe 'Branches' do
     end
 
     describe 'Delete unprotected branch' do
-      it 'removes branch after confirmation', js: true do
+      it 'removes branch after confirmation', :js do
         visit project_branches_path(project)
 
         fill_in 'branch-search', with: 'fix'
diff --git a/spec/features/projects/commit/builds_spec.rb b/spec/features/projects/commit/builds_spec.rb
index 740331fe42a..9c57626ea1d 100644
--- a/spec/features/projects/commit/builds_spec.rb
+++ b/spec/features/projects/commit/builds_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'project commit pipelines', js: true do
+feature 'project commit pipelines', :js do
   given(:project) { create(:project, :repository) }
 
   background do
diff --git a/spec/features/projects/commit/cherry_pick_spec.rb b/spec/features/projects/commit/cherry_pick_spec.rb
index 7086f56bb1b..c11a95732b2 100644
--- a/spec/features/projects/commit/cherry_pick_spec.rb
+++ b/spec/features/projects/commit/cherry_pick_spec.rb
@@ -64,7 +64,7 @@ describe 'Cherry-pick Commits' do
     end
   end
 
-  context "I cherry-pick a commit from a different branch", js: true do
+  context "I cherry-pick a commit from a different branch", :js do
     it do
       find('.header-action-buttons a.dropdown-toggle').click
       find(:css, "a[href='#modal-cherry-pick-commit']").click
diff --git a/spec/features/projects/compare_spec.rb b/spec/features/projects/compare_spec.rb
index 82d73fe8531..87ffc2a0b90 100644
--- a/spec/features/projects/compare_spec.rb
+++ b/spec/features/projects/compare_spec.rb
@@ -1,6 +1,6 @@
 require "spec_helper"
 
-describe "Compare", js: true do
+describe "Compare", :js do
   let(:user)    { create(:user) }
   let(:project) { create(:project, :repository) }
 
diff --git a/spec/features/projects/developer_views_empty_project_instructions_spec.rb b/spec/features/projects/developer_views_empty_project_instructions_spec.rb
index fe8567ce348..36809240f76 100644
--- a/spec/features/projects/developer_views_empty_project_instructions_spec.rb
+++ b/spec/features/projects/developer_views_empty_project_instructions_spec.rb
@@ -17,7 +17,7 @@ feature 'Developer views empty project instructions' do
       expect_instructions_for('http')
     end
 
-    scenario 'switches to SSH', js: true do
+    scenario 'switches to SSH', :js do
       visit_project
 
       select_protocol('SSH')
@@ -37,7 +37,7 @@ feature 'Developer views empty project instructions' do
       expect_instructions_for('ssh')
     end
 
-    scenario 'switches to HTTP', js: true do
+    scenario 'switches to HTTP', :js do
       visit_project
 
       select_protocol('HTTP')
diff --git a/spec/features/projects/edit_spec.rb b/spec/features/projects/edit_spec.rb
index 17f914c9c17..7a372757523 100644
--- a/spec/features/projects/edit_spec.rb
+++ b/spec/features/projects/edit_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Project edit', js: true do
+feature 'Project edit', :js do
   let(:admin)   { create(:admin) }
   let(:user)    { create(:user) }
   let(:project) { create(:project) }
diff --git a/spec/features/projects/environments/environments_spec.rb b/spec/features/projects/environments/environments_spec.rb
index af7ad365546..610f566c0cf 100644
--- a/spec/features/projects/environments/environments_spec.rb
+++ b/spec/features/projects/environments/environments_spec.rb
@@ -145,7 +145,7 @@ feature 'Environments page', :js do
           expect(page).to have_content(action.name.humanize)
         end
 
-        it 'allows to play a manual action', js: true do
+        it 'allows to play a manual action', :js do
           expect(action).to be_manual
 
           find('.js-dropdown-play-icon-container').click
diff --git a/spec/features/projects/features_visibility_spec.rb b/spec/features/projects/features_visibility_spec.rb
index 57722276d79..e5282b42a4f 100644
--- a/spec/features/projects/features_visibility_spec.rb
+++ b/spec/features/projects/features_visibility_spec.rb
@@ -6,7 +6,7 @@ describe 'Edit Project Settings' do
   let!(:issue) { create(:issue, project: project) }
   let(:non_member) { create(:user) }
 
-  describe 'project features visibility selectors', js: true do
+  describe 'project features visibility selectors', :js do
     before do
       project.team << [member, :master]
       sign_in(member)
@@ -163,7 +163,7 @@ describe 'Edit Project Settings' do
     end
   end
 
-  describe 'repository visibility', js: true do
+  describe 'repository visibility', :js do
     before do
       project.team << [member, :master]
       sign_in(member)
diff --git a/spec/features/projects/files/browse_files_spec.rb b/spec/features/projects/files/browse_files_spec.rb
index f62a9edd37e..84197e45dcb 100644
--- a/spec/features/projects/files/browse_files_spec.rb
+++ b/spec/features/projects/files/browse_files_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'user browses project', js: true do
+feature 'user browses project', :js do
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
 
diff --git a/spec/features/projects/files/dockerfile_dropdown_spec.rb b/spec/features/projects/files/dockerfile_dropdown_spec.rb
index cebb238dda1..3c3a5326538 100644
--- a/spec/features/projects/files/dockerfile_dropdown_spec.rb
+++ b/spec/features/projects/files/dockerfile_dropdown_spec.rb
@@ -16,7 +16,7 @@ feature 'User wants to add a Dockerfile file' do
     expect(page).to have_css('.dockerfile-selector')
   end
 
-  scenario 'user can pick a Dockerfile file from the dropdown', js: true do
+  scenario 'user can pick a Dockerfile file from the dropdown', :js do
     find('.js-dockerfile-selector').click
 
     wait_for_requests
diff --git a/spec/features/projects/files/edit_file_soft_wrap_spec.rb b/spec/features/projects/files/edit_file_soft_wrap_spec.rb
index c7e3f657639..25f7e18ac5c 100644
--- a/spec/features/projects/files/edit_file_soft_wrap_spec.rb
+++ b/spec/features/projects/files/edit_file_soft_wrap_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'User uses soft wrap whilst editing file', js: true do
+feature 'User uses soft wrap whilst editing file', :js do
   before do
     user = create(:user)
     project = create(:project, :repository)
diff --git a/spec/features/projects/files/find_file_keyboard_spec.rb b/spec/features/projects/files/find_file_keyboard_spec.rb
index 7f97fdb8cc9..618725ee781 100644
--- a/spec/features/projects/files/find_file_keyboard_spec.rb
+++ b/spec/features/projects/files/find_file_keyboard_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Find file keyboard shortcuts', js: true do
+feature 'Find file keyboard shortcuts', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, :repository) }
 
diff --git a/spec/features/projects/files/gitignore_dropdown_spec.rb b/spec/features/projects/files/gitignore_dropdown_spec.rb
index e2044c9d5aa..81d68c3d67c 100644
--- a/spec/features/projects/files/gitignore_dropdown_spec.rb
+++ b/spec/features/projects/files/gitignore_dropdown_spec.rb
@@ -13,7 +13,7 @@ feature 'User wants to add a .gitignore file' do
     expect(page).to have_css('.gitignore-selector')
   end
 
-  scenario 'user can pick a .gitignore file from the dropdown', js: true do
+  scenario 'user can pick a .gitignore file from the dropdown', :js do
     find('.js-gitignore-selector').click
     wait_for_requests
     within '.gitignore-selector' do
diff --git a/spec/features/projects/files/gitlab_ci_yml_dropdown_spec.rb b/spec/features/projects/files/gitlab_ci_yml_dropdown_spec.rb
index ab242b0b0b5..8e58fa7bd56 100644
--- a/spec/features/projects/files/gitlab_ci_yml_dropdown_spec.rb
+++ b/spec/features/projects/files/gitlab_ci_yml_dropdown_spec.rb
@@ -13,7 +13,7 @@ feature 'User wants to add a .gitlab-ci.yml file' do
     expect(page).to have_css('.gitlab-ci-yml-selector')
   end
 
-  scenario 'user can pick a template from the dropdown', js: true do
+  scenario 'user can pick a template from the dropdown', :js do
     find('.js-gitlab-ci-yml-selector').click
     wait_for_requests
     within '.gitlab-ci-yml-selector' do
diff --git a/spec/features/projects/files/project_owner_creates_license_file_spec.rb b/spec/features/projects/files/project_owner_creates_license_file_spec.rb
index 95af263bcac..6c5b1086ec1 100644
--- a/spec/features/projects/files/project_owner_creates_license_file_spec.rb
+++ b/spec/features/projects/files/project_owner_creates_license_file_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'project owner creates a license file', js: true do
+feature 'project owner creates a license file', :js do
   let(:project_master) { create(:user) }
   let(:project) { create(:project, :repository) }
   background do
diff --git a/spec/features/projects/files/project_owner_sees_link_to_create_license_file_in_empty_project_spec.rb b/spec/features/projects/files/project_owner_sees_link_to_create_license_file_in_empty_project_spec.rb
index 7bcab01c739..6c616bf0456 100644
--- a/spec/features/projects/files/project_owner_sees_link_to_create_license_file_in_empty_project_spec.rb
+++ b/spec/features/projects/files/project_owner_sees_link_to_create_license_file_in_empty_project_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'project owner sees a link to create a license file in empty project', js: true do
+feature 'project owner sees a link to create a license file in empty project', :js do
   let(:project_master) { create(:user) }
   let(:project) { create(:project) }
   background do
diff --git a/spec/features/projects/files/template_type_dropdown_spec.rb b/spec/features/projects/files/template_type_dropdown_spec.rb
index 48003eeaa87..f95a60e5194 100644
--- a/spec/features/projects/files/template_type_dropdown_spec.rb
+++ b/spec/features/projects/files/template_type_dropdown_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Template type dropdown selector', js: true do
+feature 'Template type dropdown selector', :js do
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
 
diff --git a/spec/features/projects/files/undo_template_spec.rb b/spec/features/projects/files/undo_template_spec.rb
index 9bcd5beabb8..64fe350f3dc 100644
--- a/spec/features/projects/files/undo_template_spec.rb
+++ b/spec/features/projects/files/undo_template_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Template Undo Button', js: true do
+feature 'Template Undo Button', :js do
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
 
diff --git a/spec/features/projects/gfm_autocomplete_load_spec.rb b/spec/features/projects/gfm_autocomplete_load_spec.rb
index cff3b1f5743..1c988726ae6 100644
--- a/spec/features/projects/gfm_autocomplete_load_spec.rb
+++ b/spec/features/projects/gfm_autocomplete_load_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'GFM autocomplete loading', js: true do
+describe 'GFM autocomplete loading', :js do
   let(:project) { create(:project) }
 
   before do
diff --git a/spec/features/projects/import_export/export_file_spec.rb b/spec/features/projects/import_export/export_file_spec.rb
index 62d244ff259..05776c50f9d 100644
--- a/spec/features/projects/import_export/export_file_spec.rb
+++ b/spec/features/projects/import_export/export_file_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 # It looks up for any sensitive word inside the JSON, so if a sensitive word is found
 # we''l have to either include it adding the model that includes it to the +safe_list+
 # or make sure the attribute is blacklisted in the +import_export.yml+ configuration
-feature 'Import/Export - project export integration test', js: true do
+feature 'Import/Export - project export integration test', :js do
   include Select2Helper
   include ExportFileHelper
 
diff --git a/spec/features/projects/import_export/import_file_spec.rb b/spec/features/projects/import_export/import_file_spec.rb
index e5c7781a096..c928459f911 100644
--- a/spec/features/projects/import_export/import_file_spec.rb
+++ b/spec/features/projects/import_export/import_file_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Import/Export - project import integration test', js: true do
+feature 'Import/Export - project import integration test', :js do
   include Select2Helper
 
   let(:user) { create(:user) }
diff --git a/spec/features/projects/import_export/namespace_export_file_spec.rb b/spec/features/projects/import_export/namespace_export_file_spec.rb
index 691b0e1e4ca..b6a7c3cdcdb 100644
--- a/spec/features/projects/import_export/namespace_export_file_spec.rb
+++ b/spec/features/projects/import_export/namespace_export_file_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Import/Export - Namespace export file cleanup', js: true do
+feature 'Import/Export - Namespace export file cleanup', :js do
   let(:export_path) { "#{Dir.tmpdir}/import_file_spec" }
   let(:config_hash) { YAML.load_file(Gitlab::ImportExport.config_file).deep_stringify_keys }
 
diff --git a/spec/features/projects/issuable_templates_spec.rb b/spec/features/projects/issuable_templates_spec.rb
index c9b8ef4e37b..62b23121c5a 100644
--- a/spec/features/projects/issuable_templates_spec.rb
+++ b/spec/features/projects/issuable_templates_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'issuable templates', js: true do
+feature 'issuable templates', :js do
   include ProjectForksHelper
 
   let(:user) { create(:user) }
diff --git a/spec/features/projects/jobs_spec.rb b/spec/features/projects/jobs_spec.rb
index a4ed589f3de..71702db860c 100644
--- a/spec/features/projects/jobs_spec.rb
+++ b/spec/features/projects/jobs_spec.rb
@@ -299,7 +299,7 @@ feature 'Jobs' do
       end
 
       shared_examples 'expected variables behavior' do
-        it 'shows variable key and value after click', js: true do
+        it 'shows variable key and value after click', :js do
           expect(page).to have_css('.reveal-variables')
           expect(page).not_to have_css('.js-build-variable')
           expect(page).not_to have_css('.js-build-value')
diff --git a/spec/features/projects/labels/subscription_spec.rb b/spec/features/projects/labels/subscription_spec.rb
index 5716d151250..e8c70dec854 100644
--- a/spec/features/projects/labels/subscription_spec.rb
+++ b/spec/features/projects/labels/subscription_spec.rb
@@ -13,7 +13,7 @@ feature 'Labels subscription' do
       sign_in user
     end
 
-    scenario 'users can subscribe/unsubscribe to labels', js: true do
+    scenario 'users can subscribe/unsubscribe to labels', :js do
       visit project_labels_path(project)
 
       expect(page).to have_content('bug')
diff --git a/spec/features/projects/labels/update_prioritization_spec.rb b/spec/features/projects/labels/update_prioritization_spec.rb
index 8f85e972027..d063f5c27b5 100644
--- a/spec/features/projects/labels/update_prioritization_spec.rb
+++ b/spec/features/projects/labels/update_prioritization_spec.rb
@@ -17,7 +17,7 @@ feature 'Prioritize labels' do
       sign_in user
     end
 
-    scenario 'user can prioritize a group label', js: true do
+    scenario 'user can prioritize a group label', :js do
       visit project_labels_path(project)
 
       expect(page).to have_content('Star labels to start sorting by priority')
@@ -34,7 +34,7 @@ feature 'Prioritize labels' do
       end
     end
 
-    scenario 'user can unprioritize a group label', js: true do
+    scenario 'user can unprioritize a group label', :js do
       create(:label_priority, project: project, label: feature, priority: 1)
 
       visit project_labels_path(project)
@@ -52,7 +52,7 @@ feature 'Prioritize labels' do
       end
     end
 
-    scenario 'user can prioritize a project label', js: true do
+    scenario 'user can prioritize a project label', :js do
       visit project_labels_path(project)
 
       expect(page).to have_content('Star labels to start sorting by priority')
@@ -69,7 +69,7 @@ feature 'Prioritize labels' do
       end
     end
 
-    scenario 'user can unprioritize a project label', js: true do
+    scenario 'user can unprioritize a project label', :js do
       create(:label_priority, project: project, label: bug, priority: 1)
 
       visit project_labels_path(project)
@@ -88,7 +88,7 @@ feature 'Prioritize labels' do
       end
     end
 
-    scenario 'user can sort prioritized labels and persist across reloads', js: true do
+    scenario 'user can sort prioritized labels and persist across reloads', :js do
       create(:label_priority, project: project, label: bug, priority: 1)
       create(:label_priority, project: project, label: feature, priority: 2)
 
diff --git a/spec/features/projects/members/group_requester_cannot_request_access_to_project_spec.rb b/spec/features/projects/members/group_requester_cannot_request_access_to_project_spec.rb
index c8988aa63a7..6d729f2f85f 100644
--- a/spec/features/projects/members/group_requester_cannot_request_access_to_project_spec.rb
+++ b/spec/features/projects/members/group_requester_cannot_request_access_to_project_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Projects > Members > Group requester cannot request access to project', js: true do
+feature 'Projects > Members > Group requester cannot request access to project', :js do
   let(:user) { create(:user) }
   let(:owner) { create(:user) }
   let(:group) { create(:group, :public, :access_requestable) }
diff --git a/spec/features/projects/members/groups_with_access_list_spec.rb b/spec/features/projects/members/groups_with_access_list_spec.rb
index 9950272af08..b1053982eee 100644
--- a/spec/features/projects/members/groups_with_access_list_spec.rb
+++ b/spec/features/projects/members/groups_with_access_list_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Projects > Members > Groups with access list', js: true do
+feature 'Projects > Members > Groups with access list', :js do
   let(:user) { create(:user) }
   let(:group) { create(:group, :public) }
   let(:project) { create(:project, :public) }
diff --git a/spec/features/projects/members/master_adds_member_with_expiration_date_spec.rb b/spec/features/projects/members/master_adds_member_with_expiration_date_spec.rb
index cd621b6b3ce..5f7b4ee0e77 100644
--- a/spec/features/projects/members/master_adds_member_with_expiration_date_spec.rb
+++ b/spec/features/projects/members/master_adds_member_with_expiration_date_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Projects > Members > Master adds member with expiration date', js: true do
+feature 'Projects > Members > Master adds member with expiration date', :js do
   include Select2Helper
   include ActiveSupport::Testing::TimeHelpers
 
diff --git a/spec/features/projects/pipelines/pipelines_spec.rb b/spec/features/projects/pipelines/pipelines_spec.rb
index 92486d2bc57..c35b0840248 100644
--- a/spec/features/projects/pipelines/pipelines_spec.rb
+++ b/spec/features/projects/pipelines/pipelines_spec.rb
@@ -453,7 +453,7 @@ describe 'Pipelines', :js do
         visit new_project_pipeline_path(project)
       end
 
-      context 'for valid commit', js: true do
+      context 'for valid commit', :js do
         before do
           click_button project.default_branch
 
@@ -501,7 +501,7 @@ describe 'Pipelines', :js do
       end
 
       describe 'find pipelines' do
-        it 'shows filtered pipelines', js: true do
+        it 'shows filtered pipelines', :js do
           click_button project.default_branch
 
           page.within '.dropdown-menu' do
diff --git a/spec/features/projects/project_settings_spec.rb b/spec/features/projects/project_settings_spec.rb
index 06568817757..15a5cd9990b 100644
--- a/spec/features/projects/project_settings_spec.rb
+++ b/spec/features/projects/project_settings_spec.rb
@@ -10,7 +10,7 @@ describe 'Edit Project Settings' do
     sign_in(user)
   end
 
-  describe 'Project settings section', js: true do
+  describe 'Project settings section', :js do
     it 'shows errors for invalid project name' do
       visit edit_project_path(project)
       fill_in 'project_name_edit', with: 'foo&bar'
@@ -125,7 +125,7 @@ describe 'Edit Project Settings' do
     end
   end
 
-  describe 'Transfer project section', js: true do
+  describe 'Transfer project section', :js do
     let!(:project) { create(:project, :repository, namespace: user.namespace, name: 'gitlabhq') }
     let!(:group) { create(:group) }
 
diff --git a/spec/features/projects/ref_switcher_spec.rb b/spec/features/projects/ref_switcher_spec.rb
index f0a23729220..f8695403857 100644
--- a/spec/features/projects/ref_switcher_spec.rb
+++ b/spec/features/projects/ref_switcher_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Ref switcher', js: true do
+feature 'Ref switcher', :js do
   let(:user)      { create(:user) }
   let(:project)   { create(:project, :public, :repository) }
 
diff --git a/spec/features/projects/settings/integration_settings_spec.rb b/spec/features/projects/settings/integration_settings_spec.rb
index d932c4e4d9a..cbdb7973ac8 100644
--- a/spec/features/projects/settings/integration_settings_spec.rb
+++ b/spec/features/projects/settings/integration_settings_spec.rb
@@ -76,7 +76,7 @@ feature 'Integration settings' do
         expect(page).to have_content(url)
       end
 
-      scenario 'test existing webhook', js: true do
+      scenario 'test existing webhook', :js do
         WebMock.stub_request(:post, hook.url)
         visit integrations_path
 
diff --git a/spec/features/projects/settings/pipelines_settings_spec.rb b/spec/features/projects/settings/pipelines_settings_spec.rb
index 975d204e75e..de8fbb15b9c 100644
--- a/spec/features/projects/settings/pipelines_settings_spec.rb
+++ b/spec/features/projects/settings/pipelines_settings_spec.rb
@@ -22,7 +22,7 @@ feature "Pipelines settings" do
   context 'for master' do
     given(:role) { :master }
 
-    scenario 'be allowed to change', js: true do
+    scenario 'be allowed to change', :js do
       fill_in('Test coverage parsing', with: 'coverage_regex')
       click_on 'Save changes'
 
diff --git a/spec/features/projects/settings/repository_settings_spec.rb b/spec/features/projects/settings/repository_settings_spec.rb
index 15180d4b498..a4fefb0d0e7 100644
--- a/spec/features/projects/settings/repository_settings_spec.rb
+++ b/spec/features/projects/settings/repository_settings_spec.rb
@@ -23,7 +23,7 @@ feature 'Repository settings' do
   context 'for master' do
     given(:role) { :master }
 
-    context 'Deploy Keys', js: true do
+    context 'Deploy Keys', :js do
       let(:private_deploy_key) { create(:deploy_key, title: 'private_deploy_key', public: false) }
       let(:public_deploy_key) { create(:another_deploy_key, title: 'public_deploy_key', public: true) }
       let(:new_ssh_key) { attributes_for(:key)[:key] }
diff --git a/spec/features/projects/settings/visibility_settings_spec.rb b/spec/features/projects/settings/visibility_settings_spec.rb
index 37ee6255bd1..1c3b84d0114 100644
--- a/spec/features/projects/settings/visibility_settings_spec.rb
+++ b/spec/features/projects/settings/visibility_settings_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Visibility settings', js: true do
+feature 'Visibility settings', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, namespace: user.namespace, visibility_level: 20) }
 
diff --git a/spec/features/projects/show_project_spec.rb b/spec/features/projects/show_project_spec.rb
index 1bc6fae9e7f..0b94c9eae5d 100644
--- a/spec/features/projects/show_project_spec.rb
+++ b/spec/features/projects/show_project_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Project show page', feature: true do
+describe 'Project show page', :feature do
   context 'when project pending delete' do
     let(:project) { create(:project, :empty_repo, pending_delete: true) }
 
diff --git a/spec/features/projects/user_browses_files_spec.rb b/spec/features/projects/user_browses_files_spec.rb
index b7a0b72db50..f43b11c9485 100644
--- a/spec/features/projects/user_browses_files_spec.rb
+++ b/spec/features/projects/user_browses_files_spec.rb
@@ -76,7 +76,7 @@ describe 'User browses files' do
       expect(page).to have_content('LICENSE')
     end
 
-    it 'shows files from a repository with apostroph in its name', js: true do
+    it 'shows files from a repository with apostroph in its name', :js do
       first('.js-project-refs-dropdown').click
 
       page.within('.project-refs-form') do
@@ -91,7 +91,7 @@ describe 'User browses files' do
       expect(page).not_to have_content('Loading commit data...')
     end
 
-    it 'shows the code with a leading dot in the directory', js: true do
+    it 'shows the code with a leading dot in the directory', :js do
       first('.js-project-refs-dropdown').click
 
       page.within('.project-refs-form') do
@@ -117,7 +117,7 @@ describe 'User browses files' do
       click_link('.gitignore')
     end
 
-    it 'shows a file content', js: true do
+    it 'shows a file content', :js do
       wait_for_requests
       expect(page).to have_content('*.rbc')
     end
@@ -168,7 +168,7 @@ describe 'User browses files' do
       visit(tree_path_root_ref)
     end
 
-    it 'shows a preview of a file content', js: true do
+    it 'shows a preview of a file content', :js do
       find('.add-to-tree').click
       click_link('Upload file')
       drop_in_dropzone(File.join(Rails.root, 'spec', 'fixtures', 'logo_sample.svg'))
diff --git a/spec/features/projects/user_creates_directory_spec.rb b/spec/features/projects/user_creates_directory_spec.rb
index e8f2e4813c5..052cb3188c5 100644
--- a/spec/features/projects/user_creates_directory_spec.rb
+++ b/spec/features/projects/user_creates_directory_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'User creates a directory', js: true do
+feature 'User creates a directory', :js do
   let(:fork_message) do
     "You're not allowed to make changes to this project directly. "\
     "A fork of this project has been created that you can make changes in, so you can submit a merge request."
diff --git a/spec/features/projects/user_creates_files_spec.rb b/spec/features/projects/user_creates_files_spec.rb
index 51d918bc85d..cbe70a93942 100644
--- a/spec/features/projects/user_creates_files_spec.rb
+++ b/spec/features/projects/user_creates_files_spec.rb
@@ -59,7 +59,7 @@ describe 'User creates files' do
         expect(page).to have_selector('.file-editor')
       end
 
-      it 'creates and commit a new file', js: true do
+      it 'creates and commit a new file', :js do
         execute_script("ace.edit('editor').setValue('*.rbca')")
         fill_in(:file_name, with: 'not_a_file.md')
         fill_in(:commit_message, with: 'New commit message', visible: true)
@@ -74,7 +74,7 @@ describe 'User creates files' do
         expect(page).to have_content('*.rbca')
       end
 
-      it 'creates and commit a new file with new lines at the end of file', js: true do
+      it 'creates and commit a new file with new lines at the end of file', :js do
         execute_script('ace.edit("editor").setValue("Sample\n\n\n")')
         fill_in(:file_name, with: 'not_a_file.md')
         fill_in(:commit_message, with: 'New commit message', visible: true)
@@ -89,7 +89,7 @@ describe 'User creates files' do
         expect(evaluate_script('ace.edit("editor").getValue()')).to eq("Sample\n\n\n")
       end
 
-      it 'creates and commit a new file with a directory name', js: true do
+      it 'creates and commit a new file with a directory name', :js do
         fill_in(:file_name, with: 'foo/bar/baz.txt')
 
         expect(page).to have_selector('.file-editor')
@@ -105,7 +105,7 @@ describe 'User creates files' do
         expect(page).to have_content('*.rbca')
       end
 
-      it 'creates and commit a new file specifying a new branch', js: true do
+      it 'creates and commit a new file specifying a new branch', :js do
         expect(page).to have_selector('.file-editor')
 
         execute_script("ace.edit('editor').setValue('*.rbca')")
@@ -130,7 +130,7 @@ describe 'User creates files' do
         visit(project2_tree_path_root_ref)
       end
 
-      it 'creates and commit new file in forked project', js: true do
+      it 'creates and commit new file in forked project', :js do
         find('.add-to-tree').click
         click_link('New file')
 
diff --git a/spec/features/projects/user_creates_project_spec.rb b/spec/features/projects/user_creates_project_spec.rb
index 1c3791f63ac..4a152572502 100644
--- a/spec/features/projects/user_creates_project_spec.rb
+++ b/spec/features/projects/user_creates_project_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'User creates a project', js: true do
+feature 'User creates a project', :js do
   let(:user) { create(:user) }
 
   before do
diff --git a/spec/features/projects/user_deletes_files_spec.rb b/spec/features/projects/user_deletes_files_spec.rb
index 7f48a69d9b7..9e4e92ec076 100644
--- a/spec/features/projects/user_deletes_files_spec.rb
+++ b/spec/features/projects/user_deletes_files_spec.rb
@@ -21,7 +21,7 @@ describe 'User deletes files' do
       visit(project_tree_path_root_ref)
     end
 
-    it 'deletes the file', js: true do
+    it 'deletes the file', :js do
       click_link('.gitignore')
 
       expect(page).to have_content('.gitignore')
@@ -41,7 +41,7 @@ describe 'User deletes files' do
       visit(project2_tree_path_root_ref)
     end
 
-    it 'deletes the file in a forked project', js: true do
+    it 'deletes the file in a forked project', :js do
       click_link('.gitignore')
 
       expect(page).to have_content('.gitignore')
diff --git a/spec/features/projects/user_edits_files_spec.rb b/spec/features/projects/user_edits_files_spec.rb
index 2798041fa0c..e8d83a661d4 100644
--- a/spec/features/projects/user_edits_files_spec.rb
+++ b/spec/features/projects/user_edits_files_spec.rb
@@ -18,7 +18,7 @@ describe 'User edits files' do
       visit(project_tree_path_root_ref)
     end
 
-    it 'inserts a content of a file', js: true do
+    it 'inserts a content of a file', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
       find('.file-editor', match: :first)
@@ -35,7 +35,7 @@ describe 'User edits files' do
       expect(page).not_to have_link('edit')
     end
 
-    it 'commits an edited file', js: true do
+    it 'commits an edited file', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
       find('.file-editor', match: :first)
@@ -51,7 +51,7 @@ describe 'User edits files' do
       expect(page).to have_content('*.rbca')
     end
 
-    it 'commits an edited file to a new branch', js: true do
+    it 'commits an edited file to a new branch', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
 
@@ -69,7 +69,7 @@ describe 'User edits files' do
       expect(page).to have_content('*.rbca')
     end
 
-    it 'shows the diff of an edited file', js: true do
+    it 'shows the diff of an edited file', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
       find('.file-editor', match: :first)
@@ -87,7 +87,7 @@ describe 'User edits files' do
       visit(project2_tree_path_root_ref)
     end
 
-    it 'inserts a content of a file in a forked project', js: true do
+    it 'inserts a content of a file in a forked project', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
 
@@ -108,7 +108,7 @@ describe 'User edits files' do
       expect(evaluate_script('ace.edit("editor").getValue()')).to eq('*.rbca')
     end
 
-    it 'commits an edited file in a forked project', js: true do
+    it 'commits an edited file in a forked project', :js do
       click_link('.gitignore')
       find('.js-edit-blob').click
 
diff --git a/spec/features/projects/user_interacts_with_stars_spec.rb b/spec/features/projects/user_interacts_with_stars_spec.rb
index 0ac3f8181fa..d9d2e0ab171 100644
--- a/spec/features/projects/user_interacts_with_stars_spec.rb
+++ b/spec/features/projects/user_interacts_with_stars_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe 'User interacts with project stars' do
   let(:project) { create(:project, :public, :repository) }
 
-  context 'when user is signed in', js: true do
+  context 'when user is signed in', :js do
     let(:user) { create(:user) }
 
     before do
diff --git a/spec/features/projects/user_replaces_files_spec.rb b/spec/features/projects/user_replaces_files_spec.rb
index a9628198d5b..245b6aa285b 100644
--- a/spec/features/projects/user_replaces_files_spec.rb
+++ b/spec/features/projects/user_replaces_files_spec.rb
@@ -23,7 +23,7 @@ describe 'User replaces files' do
       visit(project_tree_path_root_ref)
     end
 
-    it 'replaces an existed file with a new one', js: true do
+    it 'replaces an existed file with a new one', :js do
       click_link('.gitignore')
 
       expect(page).to have_content('.gitignore')
@@ -49,7 +49,7 @@ describe 'User replaces files' do
       visit(project2_tree_path_root_ref)
     end
 
-    it 'replaces an existed file with a new one in a forked project', js: true do
+    it 'replaces an existed file with a new one in a forked project', :js do
       click_link('.gitignore')
 
       expect(page).to have_content('.gitignore')
diff --git a/spec/features/projects/user_uploads_files_spec.rb b/spec/features/projects/user_uploads_files_spec.rb
index 8014c299980..ae51901adc6 100644
--- a/spec/features/projects/user_uploads_files_spec.rb
+++ b/spec/features/projects/user_uploads_files_spec.rb
@@ -23,7 +23,7 @@ describe 'User uploads files' do
       visit(project_tree_path_root_ref)
     end
 
-    it 'uploads and commit a new file', js: true do
+    it 'uploads and commit a new file', :js do
       find('.add-to-tree').click
       click_link('Upload file')
       drop_in_dropzone(File.join(Rails.root, 'spec', 'fixtures', 'doc_sample.txt'))
@@ -54,7 +54,7 @@ describe 'User uploads files' do
       visit(project2_tree_path_root_ref)
     end
 
-    it 'uploads and commit a new file to a forked project', js: true do
+    it 'uploads and commit a new file to a forked project', :js do
       find('.add-to-tree').click
       click_link('Upload file')
 
diff --git a/spec/features/projects/view_on_env_spec.rb b/spec/features/projects/view_on_env_spec.rb
index 2a316a0d0db..7f547a4ca1f 100644
--- a/spec/features/projects/view_on_env_spec.rb
+++ b/spec/features/projects/view_on_env_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'View on environment', js: true do
+describe 'View on environment', :js do
   let(:branch_name) { 'feature' }
   let(:file_path) { 'files/ruby/feature.rb' }
   let(:project) { create(:project, :repository) }
diff --git a/spec/features/projects/wiki/markdown_preview_spec.rb b/spec/features/projects/wiki/markdown_preview_spec.rb
index 9a4ccf3c54d..78c350c8ee4 100644
--- a/spec/features/projects/wiki/markdown_preview_spec.rb
+++ b/spec/features/projects/wiki/markdown_preview_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Projects > Wiki > User previews markdown changes', js: true do
+feature 'Projects > Wiki > User previews markdown changes', :js do
   let(:user) { create(:user) }
   let(:project) { create(:project, namespace: user.namespace) }
   let(:wiki_content) do
diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb
index 4b2c54d54b5..ac62280e4ca 100644
--- a/spec/features/projects_spec.rb
+++ b/spec/features/projects_spec.rb
@@ -57,7 +57,7 @@ feature 'Project' do
     end
   end
 
-  describe 'remove forked relationship', js: true do
+  describe 'remove forked relationship', :js do
     let(:user)    { create(:user) }
     let(:project) { fork_project(create(:project, :public), user, namespace_id: user.namespace) }
 
@@ -126,7 +126,7 @@ feature 'Project' do
     end
   end
 
-  describe 'removal', js: true do
+  describe 'removal', :js do
     let(:user)    { create(:user, username: 'test', name: 'test') }
     let(:project) { create(:project, namespace: user.namespace, name: 'project1') }
 
diff --git a/spec/features/protected_tags_spec.rb b/spec/features/protected_tags_spec.rb
index 8abd4403065..8cc6f17b8d9 100644
--- a/spec/features/protected_tags_spec.rb
+++ b/spec/features/protected_tags_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Protected Tags', js: true do
+feature 'Protected Tags', :js do
   let(:user) { create(:user, :admin) }
   let(:project) { create(:project, :repository) }
 
diff --git a/spec/features/snippets/internal_snippet_spec.rb b/spec/features/snippets/internal_snippet_spec.rb
index 3a229612235..3a2768c424f 100644
--- a/spec/features/snippets/internal_snippet_spec.rb
+++ b/spec/features/snippets/internal_snippet_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-feature 'Internal Snippets', js: true do
+feature 'Internal Snippets', :js do
   let(:internal_snippet) { create(:personal_snippet, :internal) }
 
   describe 'normal user' do
diff --git a/spec/features/tags/master_creates_tag_spec.rb b/spec/features/tags/master_creates_tag_spec.rb
index 39d79a3327b..1455345bd56 100644
--- a/spec/features/tags/master_creates_tag_spec.rb
+++ b/spec/features/tags/master_creates_tag_spec.rb
@@ -55,7 +55,7 @@ feature 'Master creates tag' do
       end
     end
 
-    scenario 'opens dropdown for ref', js: true do
+    scenario 'opens dropdown for ref', :js do
       click_link 'New tag'
       ref_row = find('.form-group:nth-of-type(2) .col-sm-10')
       page.within ref_row do
diff --git a/spec/features/tags/master_deletes_tag_spec.rb b/spec/features/tags/master_deletes_tag_spec.rb
index 80750c904b5..f5b3774122b 100644
--- a/spec/features/tags/master_deletes_tag_spec.rb
+++ b/spec/features/tags/master_deletes_tag_spec.rb
@@ -10,7 +10,7 @@ feature 'Master deletes tag' do
     visit project_tags_path(project)
   end
 
-  context 'from the tags list page', js: true do
+  context 'from the tags list page', :js do
     scenario 'deletes the tag' do
       expect(page).to have_content 'v1.1.0'
 
@@ -34,7 +34,7 @@ feature 'Master deletes tag' do
     end
   end
 
-  context 'when pre-receive hook fails', js: true do
+  context 'when pre-receive hook fails', :js do
     context 'when Gitaly operation_user_delete_tag feature is enabled' do
       before do
         allow_any_instance_of(Gitlab::GitalyClient::OperationService).to receive(:rm_tag)
@@ -48,7 +48,7 @@ feature 'Master deletes tag' do
       end
     end
 
-    context 'when Gitaly operation_user_delete_tag feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly operation_user_delete_tag feature is disabled', :skip_gitaly_mock do
       before do
         allow_any_instance_of(Gitlab::Git::HooksService).to receive(:execute)
           .and_raise(Gitlab::Git::HooksService::PreReceiveError, 'Do not delete tags')
diff --git a/spec/features/task_lists_spec.rb b/spec/features/task_lists_spec.rb
index aeb0534b733..485b0b287ad 100644
--- a/spec/features/task_lists_spec.rb
+++ b/spec/features/task_lists_spec.rb
@@ -63,7 +63,7 @@ feature 'Task Lists' do
   end
 
   describe 'for Issues' do
-    describe 'multiple tasks', js: true do
+    describe 'multiple tasks', :js do
       let!(:issue) { create(:issue, description: markdown, author: user, project: project) }
 
       it 'renders' do
@@ -103,7 +103,7 @@ feature 'Task Lists' do
       end
     end
 
-    describe 'single incomplete task', js: true do
+    describe 'single incomplete task', :js do
       let!(:issue) { create(:issue, description: singleIncompleteMarkdown, author: user, project: project) }
 
       it 'renders' do
@@ -122,7 +122,7 @@ feature 'Task Lists' do
       end
     end
 
-    describe 'single complete task', js: true do
+    describe 'single complete task', :js do
       let!(:issue) { create(:issue, description: singleCompleteMarkdown, author: user, project: project) }
 
       it 'renders' do
@@ -141,7 +141,7 @@ feature 'Task Lists' do
       end
     end
 
-    describe 'nested tasks', js: true do
+    describe 'nested tasks', :js do
       let(:issue) { create(:issue, description: nested_tasks_markdown, author: user, project: project) }
 
       before do
diff --git a/spec/features/triggers_spec.rb b/spec/features/triggers_spec.rb
index 47664de469a..548d8372a07 100644
--- a/spec/features/triggers_spec.rb
+++ b/spec/features/triggers_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Triggers', js: true do
+feature 'Triggers', :js do
   let(:trigger_title) { 'trigger desc' }
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
diff --git a/spec/features/uploads/user_uploads_file_to_note_spec.rb b/spec/features/uploads/user_uploads_file_to_note_spec.rb
index e1c95590af1..1261ffdc2ee 100644
--- a/spec/features/uploads/user_uploads_file_to_note_spec.rb
+++ b/spec/features/uploads/user_uploads_file_to_note_spec.rb
@@ -14,20 +14,20 @@ feature 'User uploads file to note' do
   end
 
   context 'before uploading' do
-    it 'shows "Attach a file" button', js: true do
+    it 'shows "Attach a file" button', :js do
       expect(page).to have_button('Attach a file')
       expect(page).not_to have_selector('.uploading-progress-container', visible: true)
     end
   end
 
   context 'uploading is in progress' do
-    it 'shows "Cancel" button on uploading', js: true do
+    it 'shows "Cancel" button on uploading', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'dk.png')], 0, false)
 
       expect(page).to have_button('Cancel')
     end
 
-    it 'cancels uploading on clicking to "Cancel" button', js: true do
+    it 'cancels uploading on clicking to "Cancel" button', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'dk.png')], 0, false)
 
       click_button 'Cancel'
@@ -37,20 +37,20 @@ feature 'User uploads file to note' do
       expect(page).not_to have_selector('.uploading-progress-container', visible: true)
     end
 
-    it 'shows "Attaching a file" message on uploading 1 file', js: true do
+    it 'shows "Attaching a file" message on uploading 1 file', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'dk.png')], 0, false)
 
       expect(page).to have_selector('.attaching-file-message', visible: true, text: 'Attaching a file -')
     end
 
-    it 'shows "Attaching 2 files" message on uploading 2 file', js: true do
+    it 'shows "Attaching 2 files" message on uploading 2 file', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'video_sample.mp4'),
                      Rails.root.join('spec', 'fixtures', 'dk.png')], 0, false)
 
       expect(page).to have_selector('.attaching-file-message', visible: true, text: 'Attaching 2 files -')
     end
 
-    it 'shows error message, "retry" and "attach a new file" link a if file is too big', js: true do
+    it 'shows error message, "retry" and "attach a new file" link a if file is too big', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'video_sample.mp4')], 0.01)
 
       error_text = 'File is too big (0.06MiB). Max filesize: 0.01MiB.'
@@ -63,7 +63,7 @@ feature 'User uploads file to note' do
   end
 
   context 'uploading is complete' do
-    it 'shows "Attach a file" button on uploading complete', js: true do
+    it 'shows "Attach a file" button on uploading complete', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'dk.png')])
       wait_for_requests
 
@@ -71,7 +71,7 @@ feature 'User uploads file to note' do
       expect(page).not_to have_selector('.uploading-progress-container', visible: true)
     end
 
-    scenario 'they see the attached file', js: true do
+    scenario 'they see the attached file', :js do
       dropzone_file([Rails.root.join('spec', 'fixtures', 'dk.png')])
       click_button 'Comment'
       wait_for_requests
diff --git a/spec/features/users/snippets_spec.rb b/spec/features/users/snippets_spec.rb
index 13760b4c2fc..8c697e33436 100644
--- a/spec/features/users/snippets_spec.rb
+++ b/spec/features/users/snippets_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Snippets tab on a user profile', js: true do
+describe 'Snippets tab on a user profile', :js do
   context 'when the user has snippets' do
     let(:user) { create(:user) }
 
diff --git a/spec/features/users_spec.rb b/spec/features/users_spec.rb
index 15b89dac572..0252c957c95 100644
--- a/spec/features/users_spec.rb
+++ b/spec/features/users_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-feature 'Users', js: true do
+feature 'Users', :js do
   let(:user) { create(:user, username: 'user1', name: 'User 1', email: 'user1@gitlab.com') }
 
   scenario 'GET /users/sign_in creates a new user account' do
diff --git a/spec/features/variables_spec.rb b/spec/features/variables_spec.rb
index 6794bf4f4ba..5d8e818f7bf 100644
--- a/spec/features/variables_spec.rb
+++ b/spec/features/variables_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe 'Project variables', js: true do
+describe 'Project variables', :js do
   let(:user)     { create(:user) }
   let(:project)  { create(:project) }
   let(:variable) { create(:ci_variable, key: 'test_key', value: 'test value') }
diff --git a/spec/helpers/projects_helper_spec.rb b/spec/helpers/projects_helper_spec.rb
index 641971485de..5777b5c4025 100644
--- a/spec/helpers/projects_helper_spec.rb
+++ b/spec/helpers/projects_helper_spec.rb
@@ -63,7 +63,7 @@ describe ProjectsHelper do
     end
   end
 
-  describe "#project_list_cache_key", clean_gitlab_redis_shared_state: true do
+  describe "#project_list_cache_key", :clean_gitlab_redis_shared_state do
     let(:project) { create(:project, :repository) }
 
     it "includes the route" do
diff --git a/spec/lib/gitlab/background_migration/migrate_system_uploads_to_new_folder_spec.rb b/spec/lib/gitlab/background_migration/migrate_system_uploads_to_new_folder_spec.rb
index 59f69d1e4b1..7b5a00c6111 100644
--- a/spec/lib/gitlab/background_migration/migrate_system_uploads_to_new_folder_spec.rb
+++ b/spec/lib/gitlab/background_migration/migrate_system_uploads_to_new_folder_spec.rb
@@ -8,7 +8,7 @@ describe Gitlab::BackgroundMigration::MigrateSystemUploadsToNewFolder do
   end
 
   describe '#perform' do
-    it 'renames the path of system-uploads', truncate: true do
+    it 'renames the path of system-uploads', :truncate do
       upload = create(:upload, model: create(:project), path: 'uploads/system/project/avatar.jpg')
 
       migration.perform('uploads/system/', 'uploads/-/system/')
diff --git a/spec/lib/gitlab/checks/force_push_spec.rb b/spec/lib/gitlab/checks/force_push_spec.rb
index 2c7ef622c51..633e319f46d 100644
--- a/spec/lib/gitlab/checks/force_push_spec.rb
+++ b/spec/lib/gitlab/checks/force_push_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Gitlab::Checks::ForcePush do
   let(:project) { create(:project, :repository) }
 
-  context "exit code checking", skip_gitaly_mock: true do
+  context "exit code checking", :skip_gitaly_mock do
     it "does not raise a runtime error if the `popen` call to git returns a zero exit code" do
       allow_any_instance_of(Gitlab::Git::RevList).to receive(:popen).and_return(['normal output', 0])
 
diff --git a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_base_spec.rb b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_base_spec.rb
index 90aa4f63dd5..596cc435bd9 100644
--- a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_base_spec.rb
+++ b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_base_spec.rb
@@ -229,7 +229,7 @@ describe Gitlab::Database::RenameReservedPathsMigration::V1::RenameBase, :trunca
     end
   end
 
-  describe '#track_rename', redis: true do
+  describe '#track_rename', :redis do
     it 'tracks a rename in redis' do
       key = 'rename:FakeRenameReservedPathMigrationV1:namespace'
 
@@ -246,7 +246,7 @@ describe Gitlab::Database::RenameReservedPathsMigration::V1::RenameBase, :trunca
     end
   end
 
-  describe '#reverts_for_type', redis: true do
+  describe '#reverts_for_type', :redis do
     it 'yields for each tracked rename' do
       subject.track_rename('project', 'old_path', 'new_path')
       subject.track_rename('project', 'old_path2', 'new_path2')
diff --git a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_namespaces_spec.rb b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_namespaces_spec.rb
index 32ac0b88a9b..1143182531f 100644
--- a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_namespaces_spec.rb
+++ b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_namespaces_spec.rb
@@ -241,7 +241,7 @@ describe Gitlab::Database::RenameReservedPathsMigration::V1::RenameNamespaces, :
     end
   end
 
-  describe '#revert_renames', redis: true do
+  describe '#revert_renames', :redis do
     it 'renames the routes back to the previous values' do
       project = create(:project, :repository, path: 'a-project', namespace: namespace)
       subject.rename_namespace(namespace)
diff --git a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_projects_spec.rb b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_projects_spec.rb
index 595e06a9748..8922370b0a0 100644
--- a/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_projects_spec.rb
+++ b/spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_projects_spec.rb
@@ -115,7 +115,7 @@ describe Gitlab::Database::RenameReservedPathsMigration::V1::RenameProjects, :tr
     end
   end
 
-  describe '#revert_renames', redis: true do
+  describe '#revert_renames', :redis do
     it 'renames the routes back to the previous values' do
       subject.rename_project(project)
 
diff --git a/spec/lib/gitlab/git/blame_spec.rb b/spec/lib/gitlab/git/blame_spec.rb
index 465c2012b05..793228701cf 100644
--- a/spec/lib/gitlab/git/blame_spec.rb
+++ b/spec/lib/gitlab/git/blame_spec.rb
@@ -73,7 +73,7 @@ describe Gitlab::Git::Blame, seed_helper: true do
     it_behaves_like 'blaming a file'
   end
 
-  context 'when Gitaly blame feature is disabled', skip_gitaly_mock: true do
+  context 'when Gitaly blame feature is disabled', :skip_gitaly_mock do
     it_behaves_like 'blaming a file'
   end
 end
diff --git a/spec/lib/gitlab/git/blob_spec.rb b/spec/lib/gitlab/git/blob_spec.rb
index f3945e748ab..412a0093d97 100644
--- a/spec/lib/gitlab/git/blob_spec.rb
+++ b/spec/lib/gitlab/git/blob_spec.rb
@@ -112,7 +112,7 @@ describe Gitlab::Git::Blob, seed_helper: true do
       it_behaves_like 'finding blobs'
     end
 
-    context 'when project_raw_show Gitaly feature is disabled', skip_gitaly_mock: true do
+    context 'when project_raw_show Gitaly feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'finding blobs'
     end
   end
@@ -150,7 +150,7 @@ describe Gitlab::Git::Blob, seed_helper: true do
       it_behaves_like 'finding blobs by ID'
     end
 
-    context 'when the blob_raw Gitaly feature is disabled', skip_gitaly_mock: true do
+    context 'when the blob_raw Gitaly feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'finding blobs by ID'
     end
   end
diff --git a/spec/lib/gitlab/git/commit_spec.rb b/spec/lib/gitlab/git/commit_spec.rb
index 3815055139a..9f4e3c49adc 100644
--- a/spec/lib/gitlab/git/commit_spec.rb
+++ b/spec/lib/gitlab/git/commit_spec.rb
@@ -261,7 +261,7 @@ describe Gitlab::Git::Commit, seed_helper: true do
       it_should_behave_like '.where'
     end
 
-    describe '.where without gitaly', skip_gitaly_mock: true do
+    describe '.where without gitaly', :skip_gitaly_mock do
       it_should_behave_like '.where'
     end
 
@@ -336,7 +336,7 @@ describe Gitlab::Git::Commit, seed_helper: true do
         it_behaves_like 'finding all commits'
       end
 
-      context 'when Gitaly find_all_commits feature is disabled', skip_gitaly_mock: true do
+      context 'when Gitaly find_all_commits feature is disabled', :skip_gitaly_mock do
         it_behaves_like 'finding all commits'
 
         context 'while applying a sort order based on the `order` option' do
@@ -405,7 +405,7 @@ describe Gitlab::Git::Commit, seed_helper: true do
     it_should_behave_like '#stats'
   end
 
-  describe '#stats with gitaly disabled', skip_gitaly_mock: true do
+  describe '#stats with gitaly disabled', :skip_gitaly_mock do
     it_should_behave_like '#stats'
   end
 
diff --git a/spec/lib/gitlab/git/repository_spec.rb b/spec/lib/gitlab/git/repository_spec.rb
index 5f12125beb2..1ee4acfd193 100644
--- a/spec/lib/gitlab/git/repository_spec.rb
+++ b/spec/lib/gitlab/git/repository_spec.rb
@@ -54,7 +54,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
   end
 
   describe "#rugged" do
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'raises a storage exception when storage is not available' do
         broken_repo = described_class.new('broken', 'a/path.git', '')
 
@@ -384,7 +384,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       end
     end
 
-    context 'when Gitaly commit_count feature is disabled', skip_gitaly_mock: true  do
+    context 'when Gitaly commit_count feature is disabled', :skip_gitaly_mock  do
       it_behaves_like 'simple commit counting'
     end
   end
@@ -418,7 +418,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'check for local branches'
     end
 
-    context 'without gitaly', skip_gitaly_mock: true do
+    context 'without gitaly', :skip_gitaly_mock do
       it_behaves_like 'check for local branches'
     end
   end
@@ -453,7 +453,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like "deleting a branch"
     end
 
-    context "when Gitaly delete_branch is disabled", skip_gitaly_mock: true do
+    context "when Gitaly delete_branch is disabled", :skip_gitaly_mock do
       it_behaves_like "deleting a branch"
     end
   end
@@ -489,7 +489,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'creating a branch'
     end
 
-    context 'when Gitaly create_branch feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly create_branch feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'creating a branch'
     end
   end
@@ -929,7 +929,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'extended commit counting'
     end
 
-    context 'when Gitaly count_commits feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly count_commits feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'extended commit counting'
     end
   end
@@ -996,7 +996,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'finding a branch'
     end
 
-    context 'when Gitaly find_branch feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly find_branch feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'finding a branch'
 
       it 'should reload Rugged::Repository and return master' do
@@ -1238,7 +1238,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'checks the existence of refs'
     end
 
-    context 'when Gitaly ref_exists feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly ref_exists feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'checks the existence of refs'
     end
   end
@@ -1260,7 +1260,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'checks the existence of tags'
     end
 
-    context 'when Gitaly ref_exists_tags feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly ref_exists_tags feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'checks the existence of tags'
     end
   end
@@ -1284,7 +1284,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like 'checks the existence of branches'
     end
 
-    context 'when Gitaly ref_exists_branches feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly ref_exists_branches feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'checks the existence of branches'
     end
   end
@@ -1361,7 +1361,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
 
     it_behaves_like 'languages'
 
-    context 'with rugged', skip_gitaly_mock: true do
+    context 'with rugged', :skip_gitaly_mock do
       it_behaves_like 'languages'
     end
   end
@@ -1467,7 +1467,7 @@ describe Gitlab::Git::Repository, seed_helper: true do
       it_behaves_like "user deleting a branch"
     end
 
-    context "when Gitaly user_delete_branch is disabled", skip_gitaly_mock: true do
+    context "when Gitaly user_delete_branch is disabled", :skip_gitaly_mock do
       it_behaves_like "user deleting a branch"
     end
   end
diff --git a/spec/lib/gitlab/git/tag_spec.rb b/spec/lib/gitlab/git/tag_spec.rb
index cc10679ef1e..6c4f538bf01 100644
--- a/spec/lib/gitlab/git/tag_spec.rb
+++ b/spec/lib/gitlab/git/tag_spec.rb
@@ -29,7 +29,7 @@ describe Gitlab::Git::Tag, seed_helper: true do
     it_behaves_like 'Gitlab::Git::Repository#tags'
   end
 
-  context 'when Gitaly tags feature is disabled', skip_gitaly_mock: true do
+  context 'when Gitaly tags feature is disabled', :skip_gitaly_mock do
     it_behaves_like 'Gitlab::Git::Repository#tags'
   end
 end
diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb
index c54327bd2e4..c9643c5da47 100644
--- a/spec/lib/gitlab/git_access_spec.rb
+++ b/spec/lib/gitlab/git_access_spec.rb
@@ -165,7 +165,7 @@ describe Gitlab::GitAccess do
         stub_application_setting(rsa_key_restriction: 4096)
       end
 
-      it 'does not allow keys which are too small', aggregate_failures: true do
+      it 'does not allow keys which are too small', :aggregate_failures do
         expect(actor).not_to be_valid
         expect { pull_access_check }.to raise_unauthorized('Your SSH key must be at least 4096 bits.')
         expect { push_access_check }.to raise_unauthorized('Your SSH key must be at least 4096 bits.')
@@ -177,7 +177,7 @@ describe Gitlab::GitAccess do
         stub_application_setting(rsa_key_restriction: ApplicationSetting::FORBIDDEN_KEY_VALUE)
       end
 
-      it 'does not allow keys which are too small', aggregate_failures: true do
+      it 'does not allow keys which are too small', :aggregate_failures do
         expect(actor).not_to be_valid
         expect { pull_access_check }.to raise_unauthorized(/Your SSH key type is forbidden/)
         expect { push_access_check }.to raise_unauthorized(/Your SSH key type is forbidden/)
diff --git a/spec/lib/gitlab/gitaly_client/ref_service_spec.rb b/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
index 6f59750b4da..8127b4842b7 100644
--- a/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
+++ b/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
@@ -84,14 +84,14 @@ describe Gitlab::GitalyClient::RefService do
     end
   end
 
-  describe '#find_ref_name', seed_helper: true do
+  describe '#find_ref_name', :seed_helper do
     subject { client.find_ref_name(SeedRepo::Commit::ID, 'refs/heads/master') }
 
     it { is_expected.to be_utf8 }
     it { is_expected.to eq('refs/heads/master') }
   end
 
-  describe '#ref_exists?', seed_helper: true do
+  describe '#ref_exists?', :seed_helper do
     it 'finds the master branch ref' do
       expect(client.ref_exists?('refs/heads/master')).to eq(true)
     end
diff --git a/spec/lib/gitlab/health_checks/fs_shards_check_spec.rb b/spec/lib/gitlab/health_checks/fs_shards_check_spec.rb
index 73dd236a5c6..4c1ca4349ea 100644
--- a/spec/lib/gitlab/health_checks/fs_shards_check_spec.rb
+++ b/spec/lib/gitlab/health_checks/fs_shards_check_spec.rb
@@ -44,7 +44,7 @@ describe Gitlab::HealthChecks::FsShardsCheck do
     describe '#readiness' do
       subject { described_class.readiness }
 
-      context 'storage has a tripped circuitbreaker', broken_storage: true do
+      context 'storage has a tripped circuitbreaker', :broken_storage do
         let(:repository_storages) { ['broken'] }
         let(:storages_paths) do
           Gitlab.config.repositories.storages
diff --git a/spec/lib/gitlab/shell_spec.rb b/spec/lib/gitlab/shell_spec.rb
index 139afa22d01..2158b2837e2 100644
--- a/spec/lib/gitlab/shell_spec.rb
+++ b/spec/lib/gitlab/shell_spec.rb
@@ -156,7 +156,7 @@ describe Gitlab::Shell do
         it_behaves_like '#add_repository'
       end
 
-      context 'without gitaly', skip_gitaly_mock: true do
+      context 'without gitaly', :skip_gitaly_mock do
         it_behaves_like '#add_repository'
       end
     end
@@ -333,7 +333,7 @@ describe Gitlab::Shell do
       end
     end
 
-    describe '#fetch_remote local', skip_gitaly_mock: true do
+    describe '#fetch_remote local', :skip_gitaly_mock do
       it_should_behave_like 'fetch_remote', false
     end
 
diff --git a/spec/lib/gitlab/workhorse_spec.rb b/spec/lib/gitlab/workhorse_spec.rb
index 4dffe2bd82f..9230d58012f 100644
--- a/spec/lib/gitlab/workhorse_spec.rb
+++ b/spec/lib/gitlab/workhorse_spec.rb
@@ -41,7 +41,7 @@ describe Gitlab::Workhorse do
       end
     end
 
-    context 'when Gitaly workhorse_archive feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly workhorse_archive feature is disabled', :skip_gitaly_mock do
       it 'sets the header correctly' do
         key, command, params = decode_workhorse_header(subject)
 
@@ -383,7 +383,7 @@ describe Gitlab::Workhorse do
       end
     end
 
-    context 'when Gitaly workhorse_raw_show feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly workhorse_raw_show feature is disabled', :skip_gitaly_mock do
       it 'sets the header correctly' do
         key, command, params = decode_workhorse_header(subject)
 
diff --git a/spec/migrations/update_upload_paths_to_system_spec.rb b/spec/migrations/update_upload_paths_to_system_spec.rb
index 0a45c5ea32d..d4a1553fb0e 100644
--- a/spec/migrations/update_upload_paths_to_system_spec.rb
+++ b/spec/migrations/update_upload_paths_to_system_spec.rb
@@ -31,7 +31,7 @@ describe UpdateUploadPathsToSystem do
     end
   end
 
-  describe "#up", truncate: true do
+  describe "#up", :truncate do
     it "updates old upload records to the new path" do
       old_upload = create(:upload, model: create(:project), path: "uploads/project/avatar.jpg")
 
@@ -41,7 +41,7 @@ describe UpdateUploadPathsToSystem do
     end
   end
 
-  describe "#down", truncate: true do
+  describe "#down", :truncate do
     it "updates the new system patsh to the old paths" do
       new_upload = create(:upload, model: create(:project), path: "uploads/-/system/project/avatar.jpg")
 
diff --git a/spec/models/member_spec.rb b/spec/models/member_spec.rb
index a07ce05a865..0a017c068ad 100644
--- a/spec/models/member_spec.rb
+++ b/spec/models/member_spec.rb
@@ -488,7 +488,7 @@ describe Member do
       member.accept_invite!(user)
     end
 
-    it "refreshes user's authorized projects", truncate: true do
+    it "refreshes user's authorized projects", :truncate do
       project = member.source
 
       expect(user.authorized_projects).not_to include(project)
@@ -523,7 +523,7 @@ describe Member do
     end
   end
 
-  describe "destroying a record", truncate: true do
+  describe "destroying a record", :truncate do
     it "refreshes user's authorized projects" do
       project = create(:project, :private)
       user    = create(:user)
diff --git a/spec/models/project_group_link_spec.rb b/spec/models/project_group_link_spec.rb
index b3513c80150..41e2ab20d69 100644
--- a/spec/models/project_group_link_spec.rb
+++ b/spec/models/project_group_link_spec.rb
@@ -30,7 +30,7 @@ describe ProjectGroupLink do
     end
   end
 
-  describe "destroying a record", truncate: true do
+  describe "destroying a record", :truncate do
     it "refreshes group users' authorized projects" do
       project     = create(:project, :private)
       group       = create(:group)
diff --git a/spec/models/repository_spec.rb b/spec/models/repository_spec.rb
index 5764c451b67..5d78aed5b4f 100644
--- a/spec/models/repository_spec.rb
+++ b/spec/models/repository_spec.rb
@@ -40,7 +40,7 @@ describe Repository do
     it { is_expected.not_to include('feature') }
     it { is_expected.not_to include('fix') }
 
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'should raise a storage error' do
         expect_to_raise_storage_error do
           broken_repository.branch_names_contains(sample_commit.id)
@@ -158,7 +158,7 @@ describe Repository do
 
       it { is_expected.to eq('c1acaa58bbcbc3eafe538cb8274ba387047b69f8') }
 
-      describe 'when storage is broken', broken_storage: true  do
+      describe 'when storage is broken', :broken_storage  do
         it 'should raise a storage error' do
           expect_to_raise_storage_error do
             broken_repository.last_commit_id_for_path(sample_commit.id, '.gitignore')
@@ -171,7 +171,7 @@ describe Repository do
       it_behaves_like 'getting last commit for path'
     end
 
-    context 'when Gitaly feature last_commit_for_path is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly feature last_commit_for_path is disabled', :skip_gitaly_mock do
       it_behaves_like 'getting last commit for path'
     end
   end
@@ -192,7 +192,7 @@ describe Repository do
         is_expected.to eq('c1acaa5')
       end
 
-      describe 'when storage is broken', broken_storage: true  do
+      describe 'when storage is broken', :broken_storage  do
         it 'should raise a storage error' do
           expect_to_raise_storage_error do
             broken_repository.last_commit_for_path(sample_commit.id, '.gitignore').id
@@ -205,7 +205,7 @@ describe Repository do
       it_behaves_like 'getting last commit ID for path'
     end
 
-    context 'when Gitaly feature last_commit_for_path is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly feature last_commit_for_path is disabled', :skip_gitaly_mock do
       it_behaves_like 'getting last commit ID for path'
     end
   end
@@ -255,11 +255,11 @@ describe Repository do
       it_behaves_like 'finding commits by message'
     end
 
-    context 'when Gitaly commits_by_message feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly commits_by_message feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'finding commits by message'
     end
 
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'should raise a storage error' do
         expect_to_raise_storage_error { broken_repository.find_commits_by_message('s') }
       end
@@ -589,7 +589,7 @@ describe Repository do
       expect(results).to match_array([])
     end
 
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'should raise a storage error' do
         expect_to_raise_storage_error do
           broken_repository.search_files_by_content('feature', 'master')
@@ -626,7 +626,7 @@ describe Repository do
       expect(results).to match_array([])
     end
 
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'should raise a storage error' do
         expect_to_raise_storage_error { broken_repository.search_files_by_name('files', 'master') }
       end
@@ -638,7 +638,7 @@ describe Repository do
     # before the actual test call
     set(:broken_repository) { create(:project, :broken_storage).repository }
 
-    describe 'when storage is broken', broken_storage: true  do
+    describe 'when storage is broken', :broken_storage  do
       it 'should raise a storage error' do
         expect_to_raise_storage_error do
           broken_repository.fetch_ref(broken_repository, source_ref: '1', target_ref: '2')
@@ -848,7 +848,7 @@ describe Repository do
       end
     end
 
-    context 'with Gitaly disabled', skip_gitaly_mock: true do
+    context 'with Gitaly disabled', :skip_gitaly_mock do
       context 'when pre hooks were successful' do
         it 'runs without errors' do
           hook = double(trigger: [true, nil])
@@ -1101,7 +1101,7 @@ describe Repository do
       expect(repository.exists?).to eq(false)
     end
 
-    context 'with broken storage', broken_storage: true do
+    context 'with broken storage', :broken_storage do
       it 'should raise a storage error' do
         expect_to_raise_storage_error { broken_repository.exists? }
       end
@@ -1113,7 +1113,7 @@ describe Repository do
       it_behaves_like 'repo exists check'
     end
 
-    context 'when repository_exists is enabled', skip_gitaly_mock: true do
+    context 'when repository_exists is enabled', :skip_gitaly_mock do
       it_behaves_like 'repo exists check'
     end
   end
@@ -1676,7 +1676,7 @@ describe Repository do
       it_behaves_like 'adding tag'
     end
 
-    context 'when Gitaly operation_user_add_tag feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly operation_user_add_tag feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'adding tag'
 
       it 'passes commit SHA to pre-receive and update hooks and tag SHA to post-receive hook' do
@@ -1735,7 +1735,7 @@ describe Repository do
       end
     end
 
-    context 'with gitaly disabled', skip_gitaly_mock: true do
+    context 'with gitaly disabled', :skip_gitaly_mock do
       it_behaves_like "user deleting a branch"
 
       let(:old_rev) { '0b4bc9a49b562e85de7cc9e834518ea6828729b9' } # git rev-parse feature
@@ -1794,7 +1794,7 @@ describe Repository do
       it_behaves_like 'removing tag'
     end
 
-    context 'when Gitaly operation_user_delete_tag feature is disabled', skip_gitaly_mock: true do
+    context 'when Gitaly operation_user_delete_tag feature is disabled', :skip_gitaly_mock do
       it_behaves_like 'removing tag'
     end
   end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index ece6968dde6..1c3c9068f12 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1525,7 +1525,7 @@ describe User do
     it { is_expected.to eq([private_group]) }
   end
 
-  describe '#authorized_projects', truncate: true do
+  describe '#authorized_projects', :truncate do
     context 'with a minimum access level' do
       it 'includes projects for which the user is an owner' do
         user = create(:user)
@@ -1877,7 +1877,7 @@ describe User do
     end
   end
 
-  describe '#refresh_authorized_projects', clean_gitlab_redis_shared_state: true do
+  describe '#refresh_authorized_projects', :clean_gitlab_redis_shared_state do
     let(:project1) { create(:project) }
     let(:project2) { create(:project) }
     let(:user) { create(:user) }
diff --git a/spec/rubocop/cop/rspec/verbose_include_metadata_spec.rb b/spec/rubocop/cop/rspec/verbose_include_metadata_spec.rb
new file mode 100644
index 00000000000..278662d32ea
--- /dev/null
+++ b/spec/rubocop/cop/rspec/verbose_include_metadata_spec.rb
@@ -0,0 +1,53 @@
+require 'spec_helper'
+require 'rubocop'
+require 'rubocop/rspec/support'
+require_relative '../../../../rubocop/cop/rspec/verbose_include_metadata'
+
+describe RuboCop::Cop::RSpec::VerboseIncludeMetadata do
+  include CopHelper
+
+  subject(:cop) { described_class.new }
+
+  let(:source_file) { 'foo_spec.rb' }
+
+  # Override `CopHelper#inspect_source` to always appear to be in a spec file,
+  # so that our RSpec-only cop actually runs
+  def inspect_source(*args)
+    super(*args, source_file)
+  end
+
+  shared_examples 'examples with include syntax' do |title|
+    it "flags violation for #{title} examples that uses verbose include syntax" do
+      inspect_source(cop, "#{title} 'Test', js: true do; end")
+
+      expect(cop.offenses.size).to eq(1)
+      offense = cop.offenses.first
+
+      expect(offense.line).to eq(1)
+      expect(cop.highlights).to eq(["#{title} 'Test', js: true"])
+      expect(offense.message).to eq('Use `:js` instead of `js: true`.')
+    end
+
+    it "doesn't flag violation for #{title} examples that uses compact include syntax", :aggregate_failures do
+      inspect_source(cop, "#{title} 'Test', :js do; end")
+
+      expect(cop.offenses).to be_empty
+    end
+
+    it "doesn't flag violation for #{title} examples that uses flag: symbol" do
+      inspect_source(cop, "#{title} 'Test', flag: :symbol do; end")
+
+      expect(cop.offenses).to be_empty
+    end
+
+    it "autocorrects #{title} examples that uses verbose syntax into compact syntax" do
+      autocorrected = autocorrect_source(cop, "#{title} 'Test', js: true do; end", source_file)
+
+      expect(autocorrected).to eql("#{title} 'Test', :js do; end")
+    end
+  end
+
+  %w(describe context feature example_group it specify example scenario its).each do |example|
+    it_behaves_like 'examples with include syntax', example
+  end
+end
diff --git a/spec/support/features/issuable_slash_commands_shared_examples.rb b/spec/support/features/issuable_slash_commands_shared_examples.rb
index 8282ba7e536..061e0d35590 100644
--- a/spec/support/features/issuable_slash_commands_shared_examples.rb
+++ b/spec/support/features/issuable_slash_commands_shared_examples.rb
@@ -29,7 +29,7 @@ shared_examples 'issuable record that supports quick actions in its description
     wait_for_requests
   end
 
-  describe "new #{issuable_type}", js: true do
+  describe "new #{issuable_type}", :js do
     context 'with commands in the description' do
       it "creates the #{issuable_type} and interpret commands accordingly" do
         case issuable_type
@@ -53,7 +53,7 @@ shared_examples 'issuable record that supports quick actions in its description
     end
   end
 
-  describe "note on #{issuable_type}", js: true do
+  describe "note on #{issuable_type}", :js do
     before do
       visit public_send("namespace_project_#{issuable_type}_path", project.namespace, project, issuable)
     end
@@ -290,7 +290,7 @@ shared_examples 'issuable record that supports quick actions in its description
     end
   end
 
-  describe "preview of note on #{issuable_type}", js: true do
+  describe "preview of note on #{issuable_type}", :js do
     it 'removes quick actions from note and explains them' do
       create(:user, username: 'bob')
 
diff --git a/spec/workers/git_garbage_collect_worker_spec.rb b/spec/workers/git_garbage_collect_worker_spec.rb
index ab656d619f4..47297de738b 100644
--- a/spec/workers/git_garbage_collect_worker_spec.rb
+++ b/spec/workers/git_garbage_collect_worker_spec.rb
@@ -104,7 +104,7 @@ describe GitGarbageCollectWorker do
       it_should_behave_like 'flushing ref caches', true
     end
 
-    context "with Gitaly turned off", skip_gitaly_mock: true do
+    context "with Gitaly turned off", :skip_gitaly_mock do
       it_should_behave_like 'flushing ref caches', false
     end
 
-- 
cgit v1.2.1


From b352462d01e3c51d09314c282e84afe075d6ad01 Mon Sep 17 00:00:00 2001
From: Annabel Dunstone Gray <annabel.dunstone@gmail.com>
Date: Sat, 7 Oct 2017 07:52:28 -0700
Subject: Fix dropdown header alignment; empty navbar positioning

---
 app/assets/stylesheets/framework/dropdowns.scss |  2 +-
 app/assets/stylesheets/framework/header.scss    | 34 ++++++++++++-------------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/app/assets/stylesheets/framework/dropdowns.scss b/app/assets/stylesheets/framework/dropdowns.scss
index 9dcf332eee2..5b950ae0ba0 100644
--- a/app/assets/stylesheets/framework/dropdowns.scss
+++ b/app/assets/stylesheets/framework/dropdowns.scss
@@ -749,7 +749,7 @@
       margin-bottom: $dropdown-vertical-offset;
     }
 
-    li {
+    li:not(.dropdown-bold-header) {
       display: block;
       padding: 0 1px;
 
diff --git a/app/assets/stylesheets/framework/header.scss b/app/assets/stylesheets/framework/header.scss
index 9b4bfae1144..22945e935ef 100644
--- a/app/assets/stylesheets/framework/header.scss
+++ b/app/assets/stylesheets/framework/header.scss
@@ -5,22 +5,6 @@
 .navbar-gitlab {
   @include new-style-dropdown;
 
-  &.navbar-empty {
-    height: $header-height;
-    background: $white-light;
-    border-bottom: 1px solid $white-normal;
-
-    .center-logo {
-      margin: 8px 0;
-      text-align: center;
-
-      .tanuki-logo,
-      img {
-        height: 36px;
-      }
-    }
-  }
-
   &.navbar-gitlab {
     padding: 0 16px;
     z-index: 1000;
@@ -550,7 +534,7 @@
     color: $gl-text-color;
     left: auto;
 
-    .current-user {
+    li.current-user {
       padding: 5px 18px;
 
       .user-name {
@@ -570,3 +554,19 @@
 .with-performance-bar .navbar-gitlab {
   top: $performance-bar-height;
 }
+
+.navbar-empty {
+  height: $header-height;
+  background: $white-light;
+  border-bottom: 1px solid $white-normal;
+
+  .center-logo {
+    margin: 8px 0;
+    text-align: center;
+
+    .tanuki-logo,
+    img {
+      height: 36px;
+    }
+  }
+}
-- 
cgit v1.2.1


From 4aa2deb4782f1f3b516bfaecdb57203765bbb123 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= <ruben@gitlab.com>
Date: Sat, 7 Oct 2017 10:47:53 -0500
Subject: Fix error with GPG signature updater when commit was deleted

---
 app/models/gpg_signature.rb                     |  2 ++
 lib/gitlab/gpg/invalid_gpg_signature_updater.rb |  2 +-
 spec/models/gpg_signature_spec.rb               | 28 +++++++++++++++++++------
 3 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/app/models/gpg_signature.rb b/app/models/gpg_signature.rb
index 675e7a2456d..bf88d75246f 100644
--- a/app/models/gpg_signature.rb
+++ b/app/models/gpg_signature.rb
@@ -60,6 +60,8 @@ class GpgSignature < ActiveRecord::Base
   end
 
   def gpg_commit
+    return unless commit
+
     Gitlab::Gpg::Commit.new(commit)
   end
 end
diff --git a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
index b7fb9dde2bc..1991911ef6a 100644
--- a/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
+++ b/lib/gitlab/gpg/invalid_gpg_signature_updater.rb
@@ -10,7 +10,7 @@ module Gitlab
           .select(:id, :commit_sha, :project_id)
           .where('gpg_key_id IS NULL OR verification_status <> ?', GpgSignature.verification_statuses[:verified])
           .where(gpg_key_primary_keyid: @gpg_key.keyids)
-          .find_each { |sig| sig.gpg_commit.update_signature!(sig) }
+          .find_each { |sig| sig.gpg_commit&.update_signature!(sig) }
       end
     end
   end
diff --git a/spec/models/gpg_signature_spec.rb b/spec/models/gpg_signature_spec.rb
index db033016c37..0136bb61c07 100644
--- a/spec/models/gpg_signature_spec.rb
+++ b/spec/models/gpg_signature_spec.rb
@@ -1,6 +1,10 @@
 require 'rails_helper'
 
 RSpec.describe GpgSignature do
+  let(:commit_sha) { '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33' }
+  let!(:project) { create(:project, :repository, path: 'sample-project') }
+  let!(:commit) { create(:commit, project: project, sha: commit_sha) }
+  let(:gpg_signature) { create(:gpg_signature, commit_sha: commit_sha) }
   let(:gpg_key) { create(:gpg_key) }
   let(:gpg_key_subkey) { create(:gpg_key_subkey) }
 
@@ -19,11 +23,6 @@ RSpec.describe GpgSignature do
 
   describe '#commit' do
     it 'fetches the commit through the project' do
-      commit_sha = '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33'
-      project = create :project, :repository
-      commit = create :commit, project: project
-      gpg_signature = create :gpg_signature, commit_sha: commit_sha
-
       expect_any_instance_of(Project).to receive(:commit).with(commit_sha).and_return(commit)
 
       gpg_signature.commit
@@ -44,11 +43,28 @@ RSpec.describe GpgSignature do
     end
 
     it 'clears gpg_key and gpg_key_subkey_id when passing nil' do
-      gpg_signature = create(:gpg_signature, gpg_key: gpg_key_subkey)
       gpg_signature.update_attribute(:gpg_key, nil)
 
       expect(gpg_signature.gpg_key_id).to be_nil
       expect(gpg_signature.gpg_key_subkey_id).to be_nil
     end
   end
+
+  describe '#gpg_commit' do
+    context 'when commit does not exist' do
+      it 'returns nil' do
+        allow(gpg_signature).to receive(:commit).and_return(nil)
+
+        expect(gpg_signature.gpg_commit).to be_nil
+      end
+    end
+
+    context 'when commit exists' do
+      it 'returns an instance of Gitlab::Gpg::Commit' do
+        allow(gpg_signature).to receive(:commit).and_return(commit)
+
+        expect(gpg_signature.gpg_commit).to be_an_instance_of(Gitlab::Gpg::Commit)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From 42bc6caee038d0abcb8636182c2c0eac70dae8e8 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 18:07:29 -0700
Subject: Trim extraneous spaces from DNs

---
 lib/gitlab/ldap/auth_hash.rb           |   4 +
 lib/gitlab/ldap/person.rb              |  41 ++++++++++-
 spec/lib/gitlab/ldap/auth_hash_spec.rb |  16 +++-
 spec/lib/gitlab/ldap/person_spec.rb    | 130 +++++++++++++++++++++++++++++++++
 4 files changed, 189 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index 4fbc5fa5262..3123da17fd9 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -3,6 +3,10 @@
 module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
+      def uid
+        Gitlab::LDAP::Person.normalize_dn(super)
+      end
+
       private
 
       def get_info(key)
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 9a6f7827b16..4299d35fabc 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -36,6 +36,12 @@ module Gitlab
         ]
       end
 
+      def self.normalize_dn(dn)
+        dn.split(/([,+=])/).map do |part|
+          normalize_dn_part(part)
+        end.join('')
+      end
+
       def initialize(entry, provider)
         Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
         @entry = entry
@@ -58,10 +64,43 @@ module Gitlab
         attribute_value(:email)
       end
 
-      delegate :dn, to: :entry
+      def dn
+        self.class.normalize_dn(entry.dn)
+      end
 
       private
 
+      def self.normalize_dn_part(part)
+        cleaned = part.strip
+
+        if cleaned.ends_with?('\\')
+          # If it ends with an escape character that is not followed by a
+          # character to be escaped, then this part may be malformed. But let's
+          # not worry too much about it, and just return it unmodified.
+          #
+          # Why? Because the reason we clean DNs is to make our simplistic
+          # string comparisons work better, even though there are all kinds of
+          # ways that equivalent DNs can vary as strings. If we run into a
+          # strange DN, we should just try to work with it.
+          #
+          # See https://www.ldap.com/ldap-dns-and-rdns for more.
+          return part unless part.ends_with?(' ')
+
+          # Ends with an escaped space (which is valid).
+          cleaned = cleaned + ' '
+        end
+
+        # Get rid of blanks. This can happen if a split character is followed by
+        # whitespace and then another split character.
+        #
+        # E.g. this DN: 'uid=john+telephoneNumber= +1 555-555-5555'
+        #
+        # Should be returned as: 'uid=john+telephoneNumber=+1 555-555-5555'
+        cleaned = '' if cleaned.blank?
+
+        cleaned
+      end
+
       def entry
         @entry
       end
diff --git a/spec/lib/gitlab/ldap/auth_hash_spec.rb b/spec/lib/gitlab/ldap/auth_hash_spec.rb
index 8370adf9211..a4bd40705df 100644
--- a/spec/lib/gitlab/ldap/auth_hash_spec.rb
+++ b/spec/lib/gitlab/ldap/auth_hash_spec.rb
@@ -4,7 +4,7 @@ describe Gitlab::LDAP::AuthHash do
   let(:auth_hash) do
     described_class.new(
       OmniAuth::AuthHash.new(
-        uid: '123456',
+        uid: given_uid,
         provider: 'ldapmain',
         info: info,
         extra: {
@@ -32,6 +32,8 @@ describe Gitlab::LDAP::AuthHash do
   end
 
   context "without overridden attributes" do
+    let(:given_uid) { 'uid=John Smith,ou=People,dc=example,dc=com' }
+
     it "has the correct username" do
       expect(auth_hash.username).to eq("123456")
     end
@@ -42,6 +44,8 @@ describe Gitlab::LDAP::AuthHash do
   end
 
   context "with overridden attributes" do
+    let(:given_uid) { 'uid=John Smith,ou=People,dc=example,dc=com' }
+
     let(:attributes) do
       {
         'username'  => %w(mail email),
@@ -61,4 +65,14 @@ describe Gitlab::LDAP::AuthHash do
       expect(auth_hash.name).to eq("John Smith")
     end
   end
+
+  describe '#uid' do
+    context 'when there is extraneous (but valid) whitespace' do
+      let(:given_uid) { 'uid     =John Smith ,  ou = People, dc=  example,dc =com' }
+
+      it 'removes the extraneous whitespace' do
+        expect(auth_hash.uid).to eq('uid=John Smith,ou=People,dc=example,dc=com')
+      end
+    end
+  end
 end
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 087c4d8c92c..74d6979cf61 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -16,6 +16,136 @@ describe Gitlab::LDAP::Person do
     )
   end
 
+  describe '.normalize_dn' do
+    context 'when there is extraneous (but valid) whitespace' do
+      it 'removes the extraneous whitespace' do
+        given    = 'uid     =John Smith ,  ou = People, dc=  example,dc =com'
+        expected = 'uid=John Smith,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+
+      context 'for a DN with a single RDN' do
+        it 'removes the extraneous whitespace' do
+          given    = 'uid  =  John Smith'
+          expected = 'uid=John Smith'
+          expect(described_class.normalize_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there are escaped characters' do
+        it 'removes extraneous whitespace without changing the escaped characters' do
+          given    = 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'
+          expected = 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
+          expect(described_class.normalize_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'with a multivalued RDN' do
+        it 'removes extraneous whitespace without modifying the multivalued RDN' do
+          given    = 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'
+          expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_dn(given)).to eq(expected)
+        end
+
+        context 'with a telephoneNumber with a space after the plus sign' do
+          # I am not sure whether a space after the telephoneNumber plus sign is valid,
+          # and I am not sure if this is "proper" behavior under these conditions, and
+          # I am not sure if it matters to us or anyone else, so rather than dig
+          # through RFCs, I am only documenting the behavior here.
+          it 'removes the space after the plus sign in the telephoneNumber' do
+            given    = 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'
+            expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+            expect(described_class.normalize_dn(given)).to eq(expected)
+          end
+        end
+      end
+    end
+
+    context 'for a null DN (empty string)' do
+      it 'returns empty string and does not error' do
+        given    = ''
+        expected = ''
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an escaped leading space in an attribute value' do
+      it 'does not remove the escaped leading space (and does not error like Net::LDAP::DN.new does)' do
+        given    = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+        expected = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an escaped trailing space in an attribute value' do
+      it 'does not remove the escaped trailing space' do
+        given    = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+        expected = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an escaped leading newline in an attribute value' do
+      it 'does not remove the escaped leading newline' do
+        given    = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+        expected = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an escaped trailing newline in an attribute value' do
+      it 'does not remove the escaped trailing newline' do
+        given    = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+        expected = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an unescaped leading newline in an attribute value' do
+      it 'does not remove the unescaped leading newline' do
+        given    = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+        expected = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'when there is an unescaped trailing newline in an attribute value' do
+      it 'does not remove the unescaped trailing newline' do
+        given    = 'uid=John Smith\n ,ou=People,dc=example,dc=com'
+        expected = 'uid=John Smith\n,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'with uppercase characters' do
+      # We may need to normalize casing at some point.
+      # I am just making it explicit that we don't at this time.
+      it 'returns the DN with unmodified casing' do
+        given    = 'UID=John Smith,ou=People,dc=example,dc=com'
+        expected = 'UID=John Smith,ou=People,dc=example,dc=com'
+        expect(described_class.normalize_dn(given)).to eq(expected)
+      end
+    end
+
+    context 'with a malformed DN' do
+      context 'when passed a UID instead of a DN' do
+        it 'returns the UID (with whitespace stripped)' do
+          given    = '  John C. Smith '
+          expected = 'John C. Smith'
+          expect(described_class.normalize_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when an equal sign is escaped' do
+        it 'returns the DN completely unmodified' do
+          given    = 'uid= foo\\=bar'
+          expected = 'uid= foo\\=bar'
+          expect(described_class.normalize_dn(given)).to eq(expected)
+        end
+      end
+    end
+  end
+
   describe '#name' do
     it 'uses the configured name attribute and handles values as an array' do
       name = 'John Doe'
-- 
cgit v1.2.1


From abe570cd0b00a6696a0bfa1c4223d9bbbff9b58f Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 21:28:54 -0700
Subject: Refactor to distinguish between UIDs and DNs

---
 lib/gitlab/ldap/auth_hash.rb        |   2 +-
 lib/gitlab/ldap/person.rb           |  29 ++++++
 spec/lib/gitlab/ldap/person_spec.rb | 170 ++++++++++++++++++++++++++++++++++--
 3 files changed, 192 insertions(+), 9 deletions(-)

diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index 3123da17fd9..da75649d6d5 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -4,7 +4,7 @@ module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
       def uid
-        Gitlab::LDAP::Person.normalize_dn(super)
+        Gitlab::LDAP::Person.normalize_uid_or_dn(super)
       end
 
       private
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 4299d35fabc..5c8924f1472 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -36,6 +36,35 @@ module Gitlab
         ]
       end
 
+      # Returns the UID or DN in a normalized form
+      def self.normalize_uid_or_dn(uid_or_dn)
+        if is_dn?(uid_or_dn)
+          normalize_dn(uid_or_dn)
+        else
+          normalize_uid(uid_or_dn)
+        end
+      end
+
+      # Returns true if the string looks like a DN rather than a UID.
+      #
+      # An empty string is technically a valid DN (null DN), although we should
+      # never need to worry about that.
+      def self.is_dn?(uid_or_dn)
+        uid_or_dn.blank? || uid_or_dn.include?('=')
+      end
+
+      # Returns the UID in a normalized form.
+      #
+      # 1. Excess spaces are stripped
+      # 2. The string is downcased (for case-insensitivity)
+      def self.normalize_uid(uid)
+        normalize_dn_part(uid)
+      end
+
+      # Returns the DN in a normalized form.
+      #
+      # 1. Excess spaces around attribute names and values are stripped
+      # 2. The string is downcased (for case-insensitivity)
       def self.normalize_dn(dn)
         dn.split(/([,+=])/).map do |part|
           normalize_dn_part(part)
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 74d6979cf61..bae6a094ca8 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -16,6 +16,146 @@ describe Gitlab::LDAP::Person do
     )
   end
 
+  describe '.normalize_uid_or_dn' do
+    context 'given a DN' do
+      context 'when there is extraneous (but valid) whitespace' do
+        it 'removes the extraneous whitespace' do
+          given    = 'uid     =John Smith ,  ou = People, dc=  example,dc =com'
+          expected = 'uid=John Smith,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+
+        context 'for a DN with a single RDN' do
+          it 'removes the extraneous whitespace' do
+            given    = 'uid  =  John Smith'
+            expected = 'uid=John Smith'
+            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+          end
+        end
+
+        context 'when there are escaped characters' do
+          it 'removes extraneous whitespace without changing the escaped characters' do
+            given    = 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'
+            expected = 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
+            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+          end
+        end
+
+        context 'with a multivalued RDN' do
+          it 'removes extraneous whitespace without modifying the multivalued RDN' do
+            given    = 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'
+            expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+          end
+
+          context 'with a telephoneNumber with a space after the plus sign' do
+            # I am not sure whether a space after the telephoneNumber plus sign is valid,
+            # and I am not sure if this is "proper" behavior under these conditions, and
+            # I am not sure if it matters to us or anyone else, so rather than dig
+            # through RFCs, I am only documenting the behavior here.
+            it 'removes the space after the plus sign in the telephoneNumber' do
+              given    = 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'
+              expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+              expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+            end
+          end
+        end
+      end
+
+      context 'for a null DN (empty string)' do
+        it 'returns empty string and does not error' do
+          given    = ''
+          expected = ''
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an escaped leading space in an attribute value' do
+        it 'does not remove the escaped leading space (and does not error like Net::LDAP::DN.new does)' do
+          given    = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+          expected = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an escaped trailing space in an attribute value' do
+        it 'does not remove the escaped trailing space' do
+          given    = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+          expected = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an escaped leading newline in an attribute value' do
+        it 'does not remove the escaped leading newline' do
+          given    = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+          expected = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an escaped trailing newline in an attribute value' do
+        it 'does not remove the escaped trailing newline' do
+          given    = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+          expected = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an unescaped leading newline in an attribute value' do
+        it 'does not remove the unescaped leading newline' do
+          given    = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+          expected = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'when there is an unescaped trailing newline in an attribute value' do
+        it 'does not remove the unescaped trailing newline' do
+          given    = 'uid=John Smith\n ,ou=People,dc=example,dc=com'
+          expected = 'uid=John Smith\n,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'with uppercase characters' do
+        # We may need to normalize casing at some point.
+        # I am just making it explicit that we don't at this time.
+        it 'returns the DN with unmodified casing' do
+          given    = 'UID=John Smith,ou=People,dc=example,dc=com'
+          expected = 'UID=John Smith,ou=People,dc=example,dc=com'
+          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+        end
+      end
+
+      context 'with a malformed DN' do
+        context 'when an equal sign is escaped' do
+          it 'returns the DN completely unmodified' do
+            given    = 'uid= foo\\=bar'
+            expected = 'uid= foo\\=bar'
+            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+          end
+        end
+      end
+    end
+
+    context 'given a UID' do
+      it 'returns the UID (with whitespace stripped)' do
+        given    = '  John C. Smith '
+        expected = 'John C. Smith'
+        expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+      end
+    end
+  end
+
+  describe '.normalize_uid' do
+    it 'returns the UID (with whitespace stripped)' do
+      given    = '  John C. Smith '
+      expected = 'John C. Smith'
+      expect(described_class.normalize_uid(given)).to eq(expected)
+    end
+  end
+
   describe '.normalize_dn' do
     context 'when there is extraneous (but valid) whitespace' do
       it 'removes the extraneous whitespace' do
@@ -128,14 +268,6 @@ describe Gitlab::LDAP::Person do
     end
 
     context 'with a malformed DN' do
-      context 'when passed a UID instead of a DN' do
-        it 'returns the UID (with whitespace stripped)' do
-          given    = '  John C. Smith '
-          expected = 'John C. Smith'
-          expect(described_class.normalize_dn(given)).to eq(expected)
-        end
-      end
-
       context 'when an equal sign is escaped' do
         it 'returns the DN completely unmodified' do
           given    = 'uid= foo\\=bar'
@@ -146,6 +278,28 @@ describe Gitlab::LDAP::Person do
     end
   end
 
+  describe '.is_dn?' do
+    context 'given a DN' do
+      context 'with a single RDN' do
+        it 'returns true' do
+          expect(described_class.is_dn?('uid=John Smith')).to be_truthy
+        end
+      end
+
+      context 'with multiple RDNs' do
+        it 'returns true' do
+          expect(described_class.is_dn?('uid=John Smith,ou=People,dc=example,dc=com')).to be_truthy
+        end
+      end
+    end
+
+    context 'given a UID' do
+      it 'returns false' do
+        expect(described_class.is_dn?('John Smith')).to be_falsey
+      end
+    end
+  end
+
   describe '#name' do
     it 'uses the configured name attribute and handles values as an array' do
       name = 'John Doe'
-- 
cgit v1.2.1


From f1773640bf74125bb09fd5af8e780d2592e922f0 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 22:28:34 -0700
Subject: Refactor spec

---
 spec/lib/gitlab/ldap/person_spec.rb | 359 +++++++++++-------------------------
 1 file changed, 105 insertions(+), 254 deletions(-)

diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index bae6a094ca8..80c24fde16a 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Gitlab::LDAP::Person do
+  using RSpec::Parameterized::TableSyntax
   include LdapHelpers
 
   let(:entry) { ldap_user_entry('john.doe') }
@@ -18,284 +19,129 @@ describe Gitlab::LDAP::Person do
 
   describe '.normalize_uid_or_dn' do
     context 'given a DN' do
-      context 'when there is extraneous (but valid) whitespace' do
-        it 'removes the extraneous whitespace' do
-          given    = 'uid     =John Smith ,  ou = People, dc=  example,dc =com'
-          expected = 'uid=John Smith,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-
-        context 'for a DN with a single RDN' do
-          it 'removes the extraneous whitespace' do
-            given    = 'uid  =  John Smith'
-            expected = 'uid=John Smith'
-            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-          end
-        end
-
-        context 'when there are escaped characters' do
-          it 'removes extraneous whitespace without changing the escaped characters' do
-            given    = 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'
-            expected = 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
-            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-          end
-        end
-
-        context 'with a multivalued RDN' do
-          it 'removes extraneous whitespace without modifying the multivalued RDN' do
-            given    = 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'
-            expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-          end
-
-          context 'with a telephoneNumber with a space after the plus sign' do
-            # I am not sure whether a space after the telephoneNumber plus sign is valid,
-            # and I am not sure if this is "proper" behavior under these conditions, and
-            # I am not sure if it matters to us or anyone else, so rather than dig
-            # through RFCs, I am only documenting the behavior here.
-            it 'removes the space after the plus sign in the telephoneNumber' do
-              given    = 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'
-              expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-              expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-            end
-          end
-        end
-      end
-
-      context 'for a null DN (empty string)' do
-        it 'returns empty string and does not error' do
-          given    = ''
-          expected = ''
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an escaped leading space in an attribute value' do
-        it 'does not remove the escaped leading space (and does not error like Net::LDAP::DN.new does)' do
-          given    = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-          expected = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an escaped trailing space in an attribute value' do
-        it 'does not remove the escaped trailing space' do
-          given    = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-          expected = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an escaped leading newline in an attribute value' do
-        it 'does not remove the escaped leading newline' do
-          given    = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-          expected = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an escaped trailing newline in an attribute value' do
-        it 'does not remove the escaped trailing newline' do
-          given    = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-          expected = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an unescaped leading newline in an attribute value' do
-        it 'does not remove the unescaped leading newline' do
-          given    = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-          expected = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there is an unescaped trailing newline in an attribute value' do
-        it 'does not remove the unescaped trailing newline' do
-          given    = 'uid=John Smith\n ,ou=People,dc=example,dc=com'
-          expected = 'uid=John Smith\n,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
+      # Regarding the telephoneNumber test:
+      #
+      # I am not sure whether a space after the telephoneNumber plus sign is valid,
+      # and I am not sure if this is "proper" behavior under these conditions, and
+      # I am not sure if it matters to us or anyone else, so rather than dig
+      # through RFCs, I am only documenting the behavior here.
+      where(:test_description, :given, :expected) do
+        'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=John Smith,ou=People,dc=example,dc=com'
+        'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=John Smith'
+        'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
+        'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+        'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+        'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
+        'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+        'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+        'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+        'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+        'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+        'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
+        'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
+        'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
+        'for a malformed DN (when an equal sign is escaped), returns the DN completely unmodified'   | 'uid= foo\\=bar'                                                                                      | 'uid= foo\\=bar'
+      end
+
+      with_them do
+        it 'normalizes the DN' do
+          assert_generic_test(test_description, described_class.normalize_uid_or_dn(given), expected)
         end
       end
+    end
 
-      context 'with uppercase characters' do
-        # We may need to normalize casing at some point.
-        # I am just making it explicit that we don't at this time.
-        it 'returns the DN with unmodified casing' do
-          given    = 'UID=John Smith,ou=People,dc=example,dc=com'
-          expected = 'UID=John Smith,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-        end
+    context 'given a UID' do
+      where(:test_description, :given, :expected) do
+        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'John C. Smith'
+        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'Sebasti\\c3\\a1n\\ C.\\20Smith\\ '
+        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ John Smith'
+        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'John Smith\\ '
+        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\nJohn Smith'
+        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'John Smith\\\n'
+        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\nJohn Smith'
+        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
+        'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
+        'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
       end
 
-      context 'with a malformed DN' do
-        context 'when an equal sign is escaped' do
-          it 'returns the DN completely unmodified' do
-            given    = 'uid= foo\\=bar'
-            expected = 'uid= foo\\=bar'
-            expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-          end
+      with_them do
+        it 'normalizes the UID' do
+          assert_generic_test(test_description, described_class.normalize_uid_or_dn(given), expected)
         end
       end
     end
-
-    context 'given a UID' do
-      it 'returns the UID (with whitespace stripped)' do
-        given    = '  John C. Smith '
-        expected = 'John C. Smith'
-        expect(described_class.normalize_uid_or_dn(given)).to eq(expected)
-      end
-    end
   end
 
   describe '.normalize_uid' do
-    it 'returns the UID (with whitespace stripped)' do
-      given    = '  John C. Smith '
-      expected = 'John C. Smith'
-      expect(described_class.normalize_uid(given)).to eq(expected)
-    end
-  end
-
-  describe '.normalize_dn' do
-    context 'when there is extraneous (but valid) whitespace' do
-      it 'removes the extraneous whitespace' do
-        given    = 'uid     =John Smith ,  ou = People, dc=  example,dc =com'
-        expected = 'uid=John Smith,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-
-      context 'for a DN with a single RDN' do
-        it 'removes the extraneous whitespace' do
-          given    = 'uid  =  John Smith'
-          expected = 'uid=John Smith'
-          expect(described_class.normalize_dn(given)).to eq(expected)
-        end
-      end
-
-      context 'when there are escaped characters' do
-        it 'removes extraneous whitespace without changing the escaped characters' do
-          given    = 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'
-          expected = 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
-          expect(described_class.normalize_dn(given)).to eq(expected)
-        end
+    context 'given a UID' do
+      where(:test_description, :given, :expected) do
+        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'John C. Smith'
+        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'Sebasti\\c3\\a1n\\ C.\\20Smith\\ '
+        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ John Smith'
+        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'John Smith\\ '
+        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\nJohn Smith'
+        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'John Smith\\\n'
+        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\nJohn Smith'
+        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
+        'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
+        'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
       end
 
-      context 'with a multivalued RDN' do
-        it 'removes extraneous whitespace without modifying the multivalued RDN' do
-          given    = 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'
-          expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-          expect(described_class.normalize_dn(given)).to eq(expected)
-        end
-
-        context 'with a telephoneNumber with a space after the plus sign' do
-          # I am not sure whether a space after the telephoneNumber plus sign is valid,
-          # and I am not sure if this is "proper" behavior under these conditions, and
-          # I am not sure if it matters to us or anyone else, so rather than dig
-          # through RFCs, I am only documenting the behavior here.
-          it 'removes the space after the plus sign in the telephoneNumber' do
-            given    = 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'
-            expected = 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-            expect(described_class.normalize_dn(given)).to eq(expected)
-          end
+      with_them do
+        it 'normalizes the UID' do
+          assert_generic_test(test_description, described_class.normalize_uid(given), expected)
         end
       end
     end
+  end
 
-    context 'for a null DN (empty string)' do
-      it 'returns empty string and does not error' do
-        given    = ''
-        expected = ''
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an escaped leading space in an attribute value' do
-      it 'does not remove the escaped leading space (and does not error like Net::LDAP::DN.new does)' do
-        given    = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-        expected = 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an escaped trailing space in an attribute value' do
-      it 'does not remove the escaped trailing space' do
-        given    = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-        expected = 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an escaped leading newline in an attribute value' do
-      it 'does not remove the escaped leading newline' do
-        given    = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-        expected = 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an escaped trailing newline in an attribute value' do
-      it 'does not remove the escaped trailing newline' do
-        given    = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-        expected = 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an unescaped leading newline in an attribute value' do
-      it 'does not remove the unescaped leading newline' do
-        given    = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-        expected = 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'when there is an unescaped trailing newline in an attribute value' do
-      it 'does not remove the unescaped trailing newline' do
-        given    = 'uid=John Smith\n ,ou=People,dc=example,dc=com'
-        expected = 'uid=John Smith\n,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'with uppercase characters' do
-      # We may need to normalize casing at some point.
-      # I am just making it explicit that we don't at this time.
-      it 'returns the DN with unmodified casing' do
-        given    = 'UID=John Smith,ou=People,dc=example,dc=com'
-        expected = 'UID=John Smith,ou=People,dc=example,dc=com'
-        expect(described_class.normalize_dn(given)).to eq(expected)
-      end
-    end
-
-    context 'with a malformed DN' do
-      context 'when an equal sign is escaped' do
-        it 'returns the DN completely unmodified' do
-          given    = 'uid= foo\\=bar'
-          expected = 'uid= foo\\=bar'
-          expect(described_class.normalize_dn(given)).to eq(expected)
-        end
+  describe '.normalize_dn' do
+    # Regarding the telephoneNumber test:
+    #
+    # I am not sure whether a space after the telephoneNumber plus sign is valid,
+    # and I am not sure if this is "proper" behavior under these conditions, and
+    # I am not sure if it matters to us or anyone else, so rather than dig
+    # through RFCs, I am only documenting the behavior here.
+    where(:test_description, :given, :expected) do
+      'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=John Smith,ou=People,dc=example,dc=com'
+      'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=John Smith'
+      'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
+      'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+      'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+      'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
+      'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ John Smith,ou=People,dc=example,dc=com'
+      'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
+      'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
+      'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
+      'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
+      'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
+      'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
+      'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
+      'for a malformed DN (when an equal sign is escaped), returns the DN completely unmodified'   | 'uid= foo\\=bar'                                                                                      | 'uid= foo\\=bar'
+    end
+
+    with_them do
+      it 'normalizes the DN' do
+        assert_generic_test(test_description, described_class.normalize_dn(given), expected)
       end
     end
   end
 
   describe '.is_dn?' do
-    context 'given a DN' do
-      context 'with a single RDN' do
-        it 'returns true' do
-          expect(described_class.is_dn?('uid=John Smith')).to be_truthy
-        end
-      end
-
-      context 'with multiple RDNs' do
-        it 'returns true' do
-          expect(described_class.is_dn?('uid=John Smith,ou=People,dc=example,dc=com')).to be_truthy
-        end
-      end
+    where(:test_description, :given, :expected) do
+      'given a DN with a single RDN'                     | 'uid=John C. Smith'                                 | true
+      'given a DN with multiple RDNs'                    | 'uid=John C. Smith,ou=People,dc=example,dc=com'     | true
+      'given a UID'                                      | 'John C. Smith'                                     | false
+      'given a DN with a single RDN with excess spaces'  | ' uid=John C. Smith   '                             | true
+      'given a DN with multiple RDNs with excess spaces' | '  uid=John C. Smith,ou=People,dc=example,dc=com  ' | true
+      'given a UID with excess spaces'                   | '   John C. Smith '                                 | false
+      'given a DN with an escaped equal sign'            | 'uid=John C. Smith,ou=People\\='                    | true
+      'given a DN with an equal sign in escaped hex'     | 'uid=John C. Smith,ou=People\\3D'                   | true
     end
 
-    context 'given a UID' do
-      it 'returns false' do
-        expect(described_class.is_dn?('John Smith')).to be_falsey
+    with_them do
+      it 'returns the expected boolean' do
+        assert_generic_test(test_description, described_class.is_dn?(given), expected)
       end
     end
   end
@@ -327,4 +173,9 @@ describe Gitlab::LDAP::Person do
       expect(person.email).to eq([user_principal_name])
     end
   end
+
+  def assert_generic_test(test_description, got, expected)
+    test_failure_message = "Failed test description: '#{test_description}'\n\n    expected: #{expected}\n         got: #{got}"
+    expect(got).to eq(expected), test_failure_message
+  end
 end
-- 
cgit v1.2.1


From 4ae32d9577d63e95c7d924cb72cce2e7b8fbdf47 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 23:09:36 -0700
Subject: Fix normalize behavior for escaped delimiter chars

---
 lib/gitlab/ldap/person.rb           |  2 +-
 spec/lib/gitlab/ldap/person_spec.rb | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 5c8924f1472..267514d0fcd 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -66,7 +66,7 @@ module Gitlab
       # 1. Excess spaces around attribute names and values are stripped
       # 2. The string is downcased (for case-insensitivity)
       def self.normalize_dn(dn)
-        dn.split(/([,+=])/).map do |part|
+        dn.split(/(?<!\\)([,+=])/).map do |part|
           normalize_dn_part(part)
         end.join('')
       end
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 80c24fde16a..58e63b52631 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -40,7 +40,10 @@ describe Gitlab::LDAP::Person do
         'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
         'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
         'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
-        'for a malformed DN (when an equal sign is escaped), returns the DN completely unmodified'   | 'uid= foo\\=bar'                                                                                      | 'uid= foo\\=bar'
+        'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+        'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3D  bar'
+        'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=John C. Smith,ou=San Francisco\\, CA'
+        'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=John C. Smith,ou=San Francisco\\2C CA'
       end
 
       with_them do
@@ -62,6 +65,10 @@ describe Gitlab::LDAP::Person do
         'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
         'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
         'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
+        'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
+        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3D  bar'
+        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'Smith\\, John C.'
+        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'Smith\\2C John C.'
       end
 
       with_them do
@@ -85,6 +92,10 @@ describe Gitlab::LDAP::Person do
         'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
         'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
         'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
+        'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
+        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3D  bar'
+        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'Smith\\, John C.'
+        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'Smith\\2C John C.'
       end
 
       with_them do
@@ -117,7 +128,10 @@ describe Gitlab::LDAP::Person do
       'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
       'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
       'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
-      'for a malformed DN (when an equal sign is escaped), returns the DN completely unmodified'   | 'uid= foo\\=bar'                                                                                      | 'uid= foo\\=bar'
+      'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+      'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3D  bar'
+      'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=John C. Smith,ou=San Francisco\\, CA'
+      'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=John C. Smith,ou=San Francisco\\2C CA'
     end
 
     with_them do
-- 
cgit v1.2.1


From a3ec58dacf0d390512144d79c8972de2c41fc60b Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 23:13:45 -0700
Subject: Downcase normalized LDAP DNs and UIDs

---
 lib/gitlab/ldap/person.rb              |   2 +-
 spec/lib/gitlab/ldap/auth_hash_spec.rb |  12 +++-
 spec/lib/gitlab/ldap/person_spec.rb    | 116 ++++++++++++++++-----------------
 3 files changed, 69 insertions(+), 61 deletions(-)

diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 267514d0fcd..d2d6aedba0f 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -100,7 +100,7 @@ module Gitlab
       private
 
       def self.normalize_dn_part(part)
-        cleaned = part.strip
+        cleaned = part.strip.downcase
 
         if cleaned.ends_with?('\\')
           # If it ends with an escape character that is not followed by a
diff --git a/spec/lib/gitlab/ldap/auth_hash_spec.rb b/spec/lib/gitlab/ldap/auth_hash_spec.rb
index a4bd40705df..1785094af10 100644
--- a/spec/lib/gitlab/ldap/auth_hash_spec.rb
+++ b/spec/lib/gitlab/ldap/auth_hash_spec.rb
@@ -68,10 +68,18 @@ describe Gitlab::LDAP::AuthHash do
 
   describe '#uid' do
     context 'when there is extraneous (but valid) whitespace' do
-      let(:given_uid) { 'uid     =John Smith ,  ou = People, dc=  example,dc =com' }
+      let(:given_uid) { 'uid     =john smith ,  ou = people, dc=  example,dc =com' }
 
       it 'removes the extraneous whitespace' do
-        expect(auth_hash.uid).to eq('uid=John Smith,ou=People,dc=example,dc=com')
+        expect(auth_hash.uid).to eq('uid=john smith,ou=people,dc=example,dc=com')
+      end
+    end
+
+    context 'when there are upper case characters' do
+      let(:given_uid) { 'UID=John Smith,ou=People,dc=example,dc=com' }
+
+      it 'downcases' do
+        expect(auth_hash.uid).to eq('uid=john smith,ou=people,dc=example,dc=com')
       end
     end
   end
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 58e63b52631..c2294e63171 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -26,24 +26,24 @@ describe Gitlab::LDAP::Person do
       # I am not sure if it matters to us or anyone else, so rather than dig
       # through RFCs, I am only documenting the behavior here.
       where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=John Smith,ou=People,dc=example,dc=com'
-        'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=John Smith'
-        'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
-        'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-        'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+        'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
+        'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
+        'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
+        'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+        'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+        'downcases the whole string'                                                                 | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
         'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
-        'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-        'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-        'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-        'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-        'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-        'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
-        'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
-        'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
+        'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+        'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+        'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
+        'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
+        'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\njohn smith,ou=people,dc=example,dc=com'
+        'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\n,ou=people,dc=example,dc=com'
+        'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
         'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3D  bar'
-        'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=John C. Smith,ou=San Francisco\\, CA'
-        'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=John C. Smith,ou=San Francisco\\2C CA'
+        'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
+        'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+        'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
       end
 
       with_them do
@@ -55,20 +55,20 @@ describe Gitlab::LDAP::Person do
 
     context 'given a UID' do
       where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'John C. Smith'
-        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'Sebasti\\c3\\a1n\\ C.\\20Smith\\ '
-        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ John Smith'
-        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'John Smith\\ '
-        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\nJohn Smith'
-        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'John Smith\\\n'
-        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\nJohn Smith'
-        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
-        'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
-        'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
+        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
+        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
+        'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
+        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
+        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
+        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
+        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
+        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
+        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
+        'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
         'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3D  bar'
-        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'Smith\\, John C.'
-        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'Smith\\2C John C.'
+        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
+        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
+        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
       end
 
       with_them do
@@ -82,20 +82,20 @@ describe Gitlab::LDAP::Person do
   describe '.normalize_uid' do
     context 'given a UID' do
       where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'John C. Smith'
-        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'Sebasti\\c3\\a1n\\ C.\\20Smith\\ '
-        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ John Smith'
-        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'John Smith\\ '
-        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\nJohn Smith'
-        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'John Smith\\\n'
-        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\nJohn Smith'
-        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'John Smith\n'
-        'does not modify casing'                                              | ' John Smith  '                         | 'John Smith'
-        'does not strip non whitespace'                                       | 'John Smith'                            | 'John Smith'
+        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
+        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
+        'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
+        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
+        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
+        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
+        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
+        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
+        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
+        'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
         'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3D  bar'
-        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'Smith\\, John C.'
-        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'Smith\\2C John C.'
+        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
+        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
+        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
       end
 
       with_them do
@@ -114,24 +114,24 @@ describe Gitlab::LDAP::Person do
     # I am not sure if it matters to us or anyone else, so rather than dig
     # through RFCs, I am only documenting the behavior here.
     where(:test_description, :given, :expected) do
-      'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=John Smith,ou=People,dc=example,dc=com'
-      'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=John Smith'
-      'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=Sebasti\\c3\\a1n\\ C.\\20Smith\\ ,ou=People (aka. \\22humans\\"),dc=example,dc=com'
-      'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
-      'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=John Smith+telephoneNumber=+1 555-555-5555,ou=People,dc=example,dc=com'
+      'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
+      'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
+      'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
+      'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'downcases the whole string'                                                                 | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
-      'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ John Smith,ou=People,dc=example,dc=com'
-      'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'
-      'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'
-      'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'
-      'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'
-      'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=John Smith\n,ou=People,dc=example,dc=com'
-      'does not modify casing'                                                                     | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'UID=John Smith,ou=People,dc=example,dc=com'
-      'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=John Smith,ou=People,dc=example,dc=com'
+      'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+      'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+      'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
+      'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\n,ou=people,dc=example,dc=com'
+      'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-      'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3D  bar'
-      'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=John C. Smith,ou=San Francisco\\, CA'
-      'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=John C. Smith,ou=San Francisco\\2C CA'
+      'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
+      'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+      'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
     end
 
     with_them do
-- 
cgit v1.2.1


From 3e83ba34d18b93dd66b7a910db40c49d0b17b659 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Sun, 17 Sep 2017 23:20:00 -0700
Subject: Dry up spec some more
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…to stop copy pasting test cases.
---
 spec/lib/gitlab/ldap/person_spec.rb | 137 ++++++++++++------------------------
 1 file changed, 46 insertions(+), 91 deletions(-)

diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index c2294e63171..bbf792462e9 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -17,96 +17,7 @@ describe Gitlab::LDAP::Person do
     )
   end
 
-  describe '.normalize_uid_or_dn' do
-    context 'given a DN' do
-      # Regarding the telephoneNumber test:
-      #
-      # I am not sure whether a space after the telephoneNumber plus sign is valid,
-      # and I am not sure if this is "proper" behavior under these conditions, and
-      # I am not sure if it matters to us or anyone else, so rather than dig
-      # through RFCs, I am only documenting the behavior here.
-      where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
-        'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-        'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
-        'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-        'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-        'downcases the whole string'                                                                 | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-        'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
-        'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ john smith,ou=people,dc=example,dc=com'
-        'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-        'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
-        'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
-        'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\njohn smith,ou=people,dc=example,dc=com'
-        'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\n,ou=people,dc=example,dc=com'
-        'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-        'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
-        'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
-        'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
-      end
-
-      with_them do
-        it 'normalizes the DN' do
-          assert_generic_test(test_description, described_class.normalize_uid_or_dn(given), expected)
-        end
-      end
-    end
-
-    context 'given a UID' do
-      where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
-        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
-        'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
-        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
-        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
-        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
-        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
-        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
-        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
-        'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
-        'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
-        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
-        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
-      end
-
-      with_them do
-        it 'normalizes the UID' do
-          assert_generic_test(test_description, described_class.normalize_uid_or_dn(given), expected)
-        end
-      end
-    end
-  end
-
-  describe '.normalize_uid' do
-    context 'given a UID' do
-      where(:test_description, :given, :expected) do
-        'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
-        'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
-        'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
-        'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
-        'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
-        'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
-        'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
-        'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
-        'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
-        'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
-        'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
-        'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
-        'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
-        'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
-      end
-
-      with_them do
-        it 'normalizes the UID' do
-          assert_generic_test(test_description, described_class.normalize_uid(given), expected)
-        end
-      end
-    end
-  end
-
-  describe '.normalize_dn' do
+  shared_examples_for 'normalizes the DN' do
     # Regarding the telephoneNumber test:
     #
     # I am not sure whether a space after the telephoneNumber plus sign is valid,
@@ -136,11 +47,55 @@ describe Gitlab::LDAP::Person do
 
     with_them do
       it 'normalizes the DN' do
-        assert_generic_test(test_description, described_class.normalize_dn(given), expected)
+        assert_generic_test(test_description, subject, expected)
       end
     end
   end
 
+  shared_examples_for 'normalizes the UID' do
+    where(:test_description, :given, :expected) do
+      'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
+      'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
+      'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
+      'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
+      'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
+      'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
+      'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
+      'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
+      'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
+      'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
+      'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
+      'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
+      'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
+      'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
+    end
+
+    with_them do
+      it 'normalizes the UID' do
+        assert_generic_test(test_description, subject, expected)
+      end
+    end
+  end
+
+  describe '.normalize_uid_or_dn' do
+    subject { described_class.normalize_uid_or_dn(given) }
+
+    it_behaves_like 'normalizes the DN'
+    it_behaves_like 'normalizes the UID'
+  end
+
+  describe '.normalize_uid' do
+    subject { described_class.normalize_uid(given) }
+
+    it_behaves_like 'normalizes the UID'
+  end
+
+  describe '.normalize_dn' do
+    subject { described_class.normalize_dn(given) }
+
+    it_behaves_like 'normalizes the DN'
+  end
+
   describe '.is_dn?' do
     where(:test_description, :given, :expected) do
       'given a DN with a single RDN'                     | 'uid=John C. Smith'                                 | true
-- 
cgit v1.2.1


From fee3c95d755182edd50168785789c8b954f12927 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 18 Sep 2017 12:30:50 -0700
Subject: Remove redundant `is_`

---
 lib/gitlab/ldap/person.rb           | 4 ++--
 spec/lib/gitlab/ldap/person_spec.rb | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index d2d6aedba0f..a4954c3fd71 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -38,7 +38,7 @@ module Gitlab
 
       # Returns the UID or DN in a normalized form
       def self.normalize_uid_or_dn(uid_or_dn)
-        if is_dn?(uid_or_dn)
+        if dn?(uid_or_dn)
           normalize_dn(uid_or_dn)
         else
           normalize_uid(uid_or_dn)
@@ -49,7 +49,7 @@ module Gitlab
       #
       # An empty string is technically a valid DN (null DN), although we should
       # never need to worry about that.
-      def self.is_dn?(uid_or_dn)
+      def self.dn?(uid_or_dn)
         uid_or_dn.blank? || uid_or_dn.include?('=')
       end
 
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index bbf792462e9..c83e2b0898e 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -96,7 +96,7 @@ describe Gitlab::LDAP::Person do
     it_behaves_like 'normalizes the DN'
   end
 
-  describe '.is_dn?' do
+  describe '.dn?' do
     where(:test_description, :given, :expected) do
       'given a DN with a single RDN'                     | 'uid=John C. Smith'                                 | true
       'given a DN with multiple RDNs'                    | 'uid=John C. Smith,ou=People,dc=example,dc=com'     | true
@@ -110,7 +110,7 @@ describe Gitlab::LDAP::Person do
 
     with_them do
       it 'returns the expected boolean' do
-        assert_generic_test(test_description, described_class.is_dn?(given), expected)
+        assert_generic_test(test_description, described_class.dn?(given), expected)
       end
     end
   end
-- 
cgit v1.2.1


From ca5ade22f3d755ad47889e41b77d8e705b6e2ccb Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 18 Sep 2017 16:08:25 -0700
Subject: Fix `dn?` for a UID with an escaped equal sign

---
 lib/gitlab/ldap/person.rb           | 2 +-
 spec/lib/gitlab/ldap/person_spec.rb | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index a4954c3fd71..ca96a099714 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -50,7 +50,7 @@ module Gitlab
       # An empty string is technically a valid DN (null DN), although we should
       # never need to worry about that.
       def self.dn?(uid_or_dn)
-        uid_or_dn.blank? || uid_or_dn.include?('=')
+        uid_or_dn.blank? || !!uid_or_dn.match(/(?<!\\)=/)
       end
 
       # Returns the UID in a normalized form.
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index c83e2b0898e..663a6ccead1 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -100,12 +100,13 @@ describe Gitlab::LDAP::Person do
     where(:test_description, :given, :expected) do
       'given a DN with a single RDN'                     | 'uid=John C. Smith'                                 | true
       'given a DN with multiple RDNs'                    | 'uid=John C. Smith,ou=People,dc=example,dc=com'     | true
-      'given a UID'                                      | 'John C. Smith'                                     | false
       'given a DN with a single RDN with excess spaces'  | ' uid=John C. Smith   '                             | true
       'given a DN with multiple RDNs with excess spaces' | '  uid=John C. Smith,ou=People,dc=example,dc=com  ' | true
-      'given a UID with excess spaces'                   | '   John C. Smith '                                 | false
       'given a DN with an escaped equal sign'            | 'uid=John C. Smith,ou=People\\='                    | true
       'given a DN with an equal sign in escaped hex'     | 'uid=John C. Smith,ou=People\\3D'                   | true
+      'given a UID'                                      | 'John C. Smith'                                     | false
+      'given a UID with excess spaces'                   | '   John C. Smith '                                 | false
+      'given a UID with an escaped equal sign'           | 'John C. \\= Smith'                                 | false
     end
 
     with_them do
-- 
cgit v1.2.1


From 79b5cbded71f00368ad92f93180ff9f0d8183a3f Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 18 Sep 2017 16:16:14 -0700
Subject: Note invalid DNs

---
 spec/lib/gitlab/ldap/person_spec.rb | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 663a6ccead1..5f5ac990c55 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -25,24 +25,24 @@ describe Gitlab::LDAP::Person do
     # I am not sure if it matters to us or anyone else, so rather than dig
     # through RFCs, I am only documenting the behavior here.
     where(:test_description, :given, :expected) do
-      'strips extraneous whitespace'                                                               | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
-      'strips extraneous whitespace for a DN with a single RDN'                                    | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-      'strips extraneous whitespace without changing escaped characters'                           | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
-      'strips extraneous whitespace without modifying the multivalued RDN'                         | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'strips the space after the plus sign in the telephoneNumber'                                | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'downcases the whole string'                                                                 | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'for a null DN (empty string), returns empty string and does not error'                      | ''                                                                                                    | ''
-      'does not strip the escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                  | 'uid=\\ john smith,ou=people,dc=example,dc=com'
-      'does not strip the escaped trailing space in an attribute value'                            | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-      'does not strip the escaped leading newline in an attribute value'                           | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip the escaped trailing newline in an attribute value'                          | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
-      'does not strip the unescaped leading newline in an attribute value'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                        | 'uid=\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip the unescaped trailing newline in an attribute value'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\n,ou=people,dc=example,dc=com'
-      'does not strip non whitespace'                                                              | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'does not treat escaped equal signs as attribute delimiters'                                 | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-      'does not treat escaped hex equal signs as attribute delimiters'                             | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
-      'does not treat escaped commas as attribute delimiters'                                      | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
-      'does not treat escaped hex commas as attribute delimiters'                                  | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
+      'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
+      'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
+      'strips extraneous whitespace without changing escaped characters'                             | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
+      'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+      'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
+      'does not strip an escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                     | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+      'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
+      'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
+      'does not strip non whitespace'                                                                | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+      'does not treat escaped equal signs as attribute delimiters'                                   | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+      'does not treat escaped hex equal signs as attribute delimiters'                               | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
+      'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+      'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
     end
 
     with_them do
-- 
cgit v1.2.1


From 010cd3dea8d8493559e2a6840b882aa4e5cce55c Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 18 Sep 2017 16:40:04 -0700
Subject: Rescue DN normalization attempts

---
 lib/gitlab/ldap/person.rb           | 15 +++++++++++++++
 spec/lib/gitlab/ldap/person_spec.rb | 24 ++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index ca96a099714..5b0d011ee00 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -43,6 +43,11 @@ module Gitlab
         else
           normalize_uid(uid_or_dn)
         end
+      rescue StandardError => e
+        Rails.logger.info("Returning original DN \"#{uid_or_dn}\" due to error during normalization attempt: #{e.message}")
+        Rails.logger.info(e.backtrace.join("\n"))
+
+        uid_or_dn
       end
 
       # Returns true if the string looks like a DN rather than a UID.
@@ -59,6 +64,11 @@ module Gitlab
       # 2. The string is downcased (for case-insensitivity)
       def self.normalize_uid(uid)
         normalize_dn_part(uid)
+      rescue StandardError => e
+        Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
+        Rails.logger.info(e.backtrace.join("\n"))
+
+        uid
       end
 
       # Returns the DN in a normalized form.
@@ -69,6 +79,11 @@ module Gitlab
         dn.split(/(?<!\\)([,+=])/).map do |part|
           normalize_dn_part(part)
         end.join('')
+      rescue StandardError => e
+        Rails.logger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
+        Rails.logger.info(e.backtrace.join("\n"))
+
+        dn
       end
 
       def initialize(entry, provider)
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 5f5ac990c55..f561fc18f2a 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -82,18 +82,42 @@ describe Gitlab::LDAP::Person do
 
     it_behaves_like 'normalizes the DN'
     it_behaves_like 'normalizes the UID'
+
+    context 'with an exception during normalization' do
+      let(:given) { described_class } # just something that will cause an exception
+
+      it 'returns the given object unmodified' do
+        expect(subject).to eq(given)
+      end
+    end
   end
 
   describe '.normalize_uid' do
     subject { described_class.normalize_uid(given) }
 
     it_behaves_like 'normalizes the UID'
+
+    context 'with an exception during normalization' do
+      let(:given) { described_class } # just something that will cause an exception
+
+      it 'returns the given UID unmodified' do
+        expect(subject).to eq(given)
+      end
+    end
   end
 
   describe '.normalize_dn' do
     subject { described_class.normalize_dn(given) }
 
     it_behaves_like 'normalizes the DN'
+
+    context 'with an exception during normalization' do
+      let(:given) { described_class } # just something that will cause an exception
+
+      it 'returns the given DN unmodified' do
+        expect(subject).to eq(given)
+      end
+    end
   end
 
   describe '.dn?' do
-- 
cgit v1.2.1


From aefc96ca27287cc5d23653606c2cc27114b8fa09 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 19 Sep 2017 10:38:18 -0700
Subject: Rely on LDAP providers giving DNs, not UIDs

---
 lib/gitlab/ldap/auth_hash.rb        |  2 +-
 lib/gitlab/ldap/person.rb           | 22 ----------------------
 spec/lib/gitlab/ldap/person_spec.rb | 35 -----------------------------------
 3 files changed, 1 insertion(+), 58 deletions(-)

diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index da75649d6d5..3123da17fd9 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -4,7 +4,7 @@ module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
       def uid
-        Gitlab::LDAP::Person.normalize_uid_or_dn(super)
+        Gitlab::LDAP::Person.normalize_dn(super)
       end
 
       private
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 5b0d011ee00..6b1a308d521 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -36,28 +36,6 @@ module Gitlab
         ]
       end
 
-      # Returns the UID or DN in a normalized form
-      def self.normalize_uid_or_dn(uid_or_dn)
-        if dn?(uid_or_dn)
-          normalize_dn(uid_or_dn)
-        else
-          normalize_uid(uid_or_dn)
-        end
-      rescue StandardError => e
-        Rails.logger.info("Returning original DN \"#{uid_or_dn}\" due to error during normalization attempt: #{e.message}")
-        Rails.logger.info(e.backtrace.join("\n"))
-
-        uid_or_dn
-      end
-
-      # Returns true if the string looks like a DN rather than a UID.
-      #
-      # An empty string is technically a valid DN (null DN), although we should
-      # never need to worry about that.
-      def self.dn?(uid_or_dn)
-        uid_or_dn.blank? || !!uid_or_dn.match(/(?<!\\)=/)
-      end
-
       # Returns the UID in a normalized form.
       #
       # 1. Excess spaces are stripped
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index f561fc18f2a..38458549751 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -77,21 +77,6 @@ describe Gitlab::LDAP::Person do
     end
   end
 
-  describe '.normalize_uid_or_dn' do
-    subject { described_class.normalize_uid_or_dn(given) }
-
-    it_behaves_like 'normalizes the DN'
-    it_behaves_like 'normalizes the UID'
-
-    context 'with an exception during normalization' do
-      let(:given) { described_class } # just something that will cause an exception
-
-      it 'returns the given object unmodified' do
-        expect(subject).to eq(given)
-      end
-    end
-  end
-
   describe '.normalize_uid' do
     subject { described_class.normalize_uid(given) }
 
@@ -120,26 +105,6 @@ describe Gitlab::LDAP::Person do
     end
   end
 
-  describe '.dn?' do
-    where(:test_description, :given, :expected) do
-      'given a DN with a single RDN'                     | 'uid=John C. Smith'                                 | true
-      'given a DN with multiple RDNs'                    | 'uid=John C. Smith,ou=People,dc=example,dc=com'     | true
-      'given a DN with a single RDN with excess spaces'  | ' uid=John C. Smith   '                             | true
-      'given a DN with multiple RDNs with excess spaces' | '  uid=John C. Smith,ou=People,dc=example,dc=com  ' | true
-      'given a DN with an escaped equal sign'            | 'uid=John C. Smith,ou=People\\='                    | true
-      'given a DN with an equal sign in escaped hex'     | 'uid=John C. Smith,ou=People\\3D'                   | true
-      'given a UID'                                      | 'John C. Smith'                                     | false
-      'given a UID with excess spaces'                   | '   John C. Smith '                                 | false
-      'given a UID with an escaped equal sign'           | 'John C. \\= Smith'                                 | false
-    end
-
-    with_them do
-      it 'returns the expected boolean' do
-        assert_generic_test(test_description, described_class.dn?(given), expected)
-      end
-    end
-  end
-
   describe '#name' do
     it 'uses the configured name attribute and handles values as an array' do
       name = 'John Doe'
-- 
cgit v1.2.1


From 7bc4278e07e2386fa35039e23af027a092623b32 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 10:57:50 -0700
Subject: Extract Net::LDAP::DN class from ruby-net-ldap gem

---
 lib/gitlab/ldap/dn.rb | 224 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 224 insertions(+)
 create mode 100644 lib/gitlab/ldap/dn.rb

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
new file mode 100644
index 00000000000..e314b80e578
--- /dev/null
+++ b/lib/gitlab/ldap/dn.rb
@@ -0,0 +1,224 @@
+# -*- ruby encoding: utf-8 -*-
+
+##
+# Objects of this class represent an LDAP DN ("Distinguished Name"). A DN
+# ("Distinguished Name") is a unique identifier for an entry within an LDAP
+# directory. It is made up of a number of other attributes strung together,
+# to identify the entry in the tree.
+#
+# Each attribute that makes up a DN needs to have its value escaped so that
+# the DN is valid. This class helps take care of that.
+#
+# A fully escaped DN needs to be unescaped when analysing its contents. This
+# class also helps take care of that.
+class Net::LDAP::DN
+  ##
+  # Initialize a DN, escaping as required. Pass in attributes in name/value
+  # pairs. If there is a left over argument, it will be appended to the dn
+  # without escaping (useful for a base string).
+  #
+  # Most uses of this class will be to escape a DN, rather than to parse it,
+  # so storing the dn as an escaped String and parsing parts as required
+  # with a state machine seems sensible.
+  def initialize(*args)
+    buffer = StringIO.new
+
+    args.each_index do |index|
+      buffer << "=" if index % 2 == 1
+      buffer << "," if index % 2 == 0 && index != 0
+
+      if index < args.length - 1 || index % 2 == 1
+        buffer << Net::LDAP::DN.escape(args[index])
+      else
+        buffer << args[index]
+      end
+    end
+
+    @dn = buffer.string
+  end
+
+  ##
+  # Parse a DN into key value pairs using ASN from
+  # http://tools.ietf.org/html/rfc2253 section 3.
+  def each_pair
+    state = :key
+    key = StringIO.new
+    value = StringIO.new
+    hex_buffer = ""
+
+    @dn.each_char do |char|
+      case state
+      when :key then
+        case char
+        when 'a'..'z', 'A'..'Z' then
+          state = :key_normal
+          key << char
+        when '0'..'9' then
+          state = :key_oid
+          key << char
+        when ' ' then state = :key
+        else raise "DN badly formed"
+        end
+      when :key_normal then
+        case char
+        when '=' then state = :value
+        when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
+        else raise "DN badly formed"
+        end
+      when :key_oid then
+        case char
+        when '=' then state = :value
+        when '0'..'9', '.', ' ' then key << char
+        else raise "DN badly formed"
+        end
+      when :value then
+        case char
+        when '\\' then state = :value_normal_escape
+        when '"' then state = :value_quoted
+        when ' ' then state = :value
+        when '#' then
+          state = :value_hexstring
+          value << char
+        when ',' then
+          state = :key
+          yield key.string.strip, value.string.rstrip
+          key = StringIO.new
+          value = StringIO.new;
+        else
+          state = :value_normal
+          value << char
+        end
+      when :value_normal then
+        case char
+        when '\\' then state = :value_normal_escape
+        when ',' then
+          state = :key
+          yield key.string.strip, value.string.rstrip
+          key = StringIO.new
+          value = StringIO.new;
+        else value << char
+        end
+      when :value_normal_escape then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_normal_escape_hex
+          hex_buffer = char
+        else state = :value_normal; value << char
+        end
+      when :value_normal_escape_hex then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_normal
+          value << "#{hex_buffer}#{char}".to_i(16).chr
+        else raise "DN badly formed"
+        end
+      when :value_quoted then
+        case char
+        when '\\' then state = :value_quoted_escape
+        when '"' then state = :value_end
+        else value << char
+        end
+      when :value_quoted_escape then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_quoted_escape_hex
+          hex_buffer = char
+        else
+          state = :value_quoted;
+          value << char
+        end
+      when :value_quoted_escape_hex then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_quoted
+          value << "#{hex_buffer}#{char}".to_i(16).chr
+        else raise "DN badly formed"
+        end
+      when :value_hexstring then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_hexstring_hex
+          value << char
+        when ' ' then state = :value_end
+        when ',' then
+          state = :key
+          yield key.string.strip, value.string.rstrip
+          key = StringIO.new
+          value = StringIO.new;
+        else raise "DN badly formed"
+        end
+      when :value_hexstring_hex then
+        case char
+        when '0'..'9', 'a'..'f', 'A'..'F' then
+          state = :value_hexstring
+          value << char
+        else raise "DN badly formed"
+        end
+      when :value_end then
+        case char
+        when ' ' then state = :value_end
+        when ',' then
+          state = :key
+          yield key.string.strip, value.string.rstrip
+          key = StringIO.new
+          value = StringIO.new;
+        else raise "DN badly formed"
+        end
+      else raise "Fell out of state machine"
+      end
+    end
+
+    # Last pair
+    raise "DN badly formed" unless
+      [:value, :value_normal, :value_hexstring, :value_end].include? state
+
+    yield key.string.strip, value.string.rstrip
+  end
+
+  ##
+  # Returns the DN as an array in the form expected by the constructor.
+  def to_a
+    a = []
+    self.each_pair { |key, value| a << key << value }
+    a
+  end
+
+  ##
+  # Return the DN as an escaped string.
+  def to_s
+    @dn
+  end
+
+  # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
+  # for dn values. All of the following must be escaped in any normal string
+  # using a single backslash ('\') as escape.
+  ESCAPES = {
+    ','  => ',',
+    '+'  => '+',
+    '"'  => '"',
+    '\\' => '\\',
+    '<' => '<',
+    '>' => '>',
+    ';' => ';',
+  }
+
+  # Compiled character class regexp using the keys from the above hash, and
+  # checking for a space or # at the start, or space at the end, of the
+  # string.
+  ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
+                         ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                         "])")
+
+  ##
+  # Escape a string for use in a DN value
+  def self.escape(string)
+    string.gsub(ESCAPE_RE) { |char| "\\" + ESCAPES[char] }
+  end
+
+  ##
+  # Proxy all other requests to the string object, because a DN is mainly
+  # used within the library as a string
+  def method_missing(method, *args, &block)
+    @dn.send(method, *args, &block)
+  end
+end
-- 
cgit v1.2.1


From 2f11db4b005f67fe7687dd15267062556e8431ad Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 11:01:11 -0700
Subject: Adapt DN class for Gitlab

---
 lib/gitlab/ldap/dn.rb | 402 ++++++++++++++++++++++++++------------------------
 1 file changed, 207 insertions(+), 195 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index e314b80e578..038476b2d2a 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -1,5 +1,13 @@
 # -*- ruby encoding: utf-8 -*-
 
+# Based on the `ruby-net-ldap` gem's `Net::LDAP::DN`
+#
+# For our purposes, this class is used to normalize DNs in order to allow proper
+# comparison.
+#
+# E.g. DNs should be compared case-insensitively (in basically all LDAP
+# implementations or setups), therefore we downcase every DN.
+
 ##
 # Objects of this class represent an LDAP DN ("Distinguished Name"). A DN
 # ("Distinguished Name") is a unique identifier for an entry within an LDAP
@@ -11,214 +19,218 @@
 #
 # A fully escaped DN needs to be unescaped when analysing its contents. This
 # class also helps take care of that.
-class Net::LDAP::DN
-  ##
-  # Initialize a DN, escaping as required. Pass in attributes in name/value
-  # pairs. If there is a left over argument, it will be appended to the dn
-  # without escaping (useful for a base string).
-  #
-  # Most uses of this class will be to escape a DN, rather than to parse it,
-  # so storing the dn as an escaped String and parsing parts as required
-  # with a state machine seems sensible.
-  def initialize(*args)
-    buffer = StringIO.new
+module Gitlab
+  module LDAP
+    class DN
+      ##
+      # Initialize a DN, escaping as required. Pass in attributes in name/value
+      # pairs. If there is a left over argument, it will be appended to the dn
+      # without escaping (useful for a base string).
+      #
+      # Most uses of this class will be to escape a DN, rather than to parse it,
+      # so storing the dn as an escaped String and parsing parts as required
+      # with a state machine seems sensible.
+      def initialize(*args)
+        buffer = StringIO.new
 
-    args.each_index do |index|
-      buffer << "=" if index % 2 == 1
-      buffer << "," if index % 2 == 0 && index != 0
+        args.each_index do |index|
+          buffer << "=" if index % 2 == 1
+          buffer << "," if index % 2 == 0 && index != 0
 
-      if index < args.length - 1 || index % 2 == 1
-        buffer << Net::LDAP::DN.escape(args[index])
-      else
-        buffer << args[index]
-      end
-    end
+          if index < args.length - 1 || index % 2 == 1
+            buffer << Net::LDAP::DN.escape(args[index])
+          else
+            buffer << args[index]
+          end
+        end
 
-    @dn = buffer.string
-  end
+        @dn = buffer.string
+      end
 
-  ##
-  # Parse a DN into key value pairs using ASN from
-  # http://tools.ietf.org/html/rfc2253 section 3.
-  def each_pair
-    state = :key
-    key = StringIO.new
-    value = StringIO.new
-    hex_buffer = ""
+      ##
+      # Parse a DN into key value pairs using ASN from
+      # http://tools.ietf.org/html/rfc2253 section 3.
+      def each_pair
+        state = :key
+        key = StringIO.new
+        value = StringIO.new
+        hex_buffer = ""
 
-    @dn.each_char do |char|
-      case state
-      when :key then
-        case char
-        when 'a'..'z', 'A'..'Z' then
-          state = :key_normal
-          key << char
-        when '0'..'9' then
-          state = :key_oid
-          key << char
-        when ' ' then state = :key
-        else raise "DN badly formed"
-        end
-      when :key_normal then
-        case char
-        when '=' then state = :value
-        when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
-        else raise "DN badly formed"
-        end
-      when :key_oid then
-        case char
-        when '=' then state = :value
-        when '0'..'9', '.', ' ' then key << char
-        else raise "DN badly formed"
-        end
-      when :value then
-        case char
-        when '\\' then state = :value_normal_escape
-        when '"' then state = :value_quoted
-        when ' ' then state = :value
-        when '#' then
-          state = :value_hexstring
-          value << char
-        when ',' then
-          state = :key
-          yield key.string.strip, value.string.rstrip
-          key = StringIO.new
-          value = StringIO.new;
-        else
-          state = :value_normal
-          value << char
-        end
-      when :value_normal then
-        case char
-        when '\\' then state = :value_normal_escape
-        when ',' then
-          state = :key
-          yield key.string.strip, value.string.rstrip
-          key = StringIO.new
-          value = StringIO.new;
-        else value << char
-        end
-      when :value_normal_escape then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_normal_escape_hex
-          hex_buffer = char
-        else state = :value_normal; value << char
-        end
-      when :value_normal_escape_hex then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_normal
-          value << "#{hex_buffer}#{char}".to_i(16).chr
-        else raise "DN badly formed"
-        end
-      when :value_quoted then
-        case char
-        when '\\' then state = :value_quoted_escape
-        when '"' then state = :value_end
-        else value << char
-        end
-      when :value_quoted_escape then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_quoted_escape_hex
-          hex_buffer = char
-        else
-          state = :value_quoted;
-          value << char
+        @dn.each_char do |char|
+          case state
+          when :key then
+            case char
+            when 'a'..'z', 'A'..'Z' then
+              state = :key_normal
+              key << char
+            when '0'..'9' then
+              state = :key_oid
+              key << char
+            when ' ' then state = :key
+            else raise "DN badly formed"
+            end
+          when :key_normal then
+            case char
+            when '=' then state = :value
+            when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
+            else raise "DN badly formed"
+            end
+          when :key_oid then
+            case char
+            when '=' then state = :value
+            when '0'..'9', '.', ' ' then key << char
+            else raise "DN badly formed"
+            end
+          when :value then
+            case char
+            when '\\' then state = :value_normal_escape
+            when '"' then state = :value_quoted
+            when ' ' then state = :value
+            when '#' then
+              state = :value_hexstring
+              value << char
+            when ',' then
+              state = :key
+              yield key.string.strip, value.string.rstrip
+              key = StringIO.new
+              value = StringIO.new;
+            else
+              state = :value_normal
+              value << char
+            end
+          when :value_normal then
+            case char
+            when '\\' then state = :value_normal_escape
+            when ',' then
+              state = :key
+              yield key.string.strip, value.string.rstrip
+              key = StringIO.new
+              value = StringIO.new;
+            else value << char
+            end
+          when :value_normal_escape then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_normal_escape_hex
+              hex_buffer = char
+            else state = :value_normal; value << char
+            end
+          when :value_normal_escape_hex then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_normal
+              value << "#{hex_buffer}#{char}".to_i(16).chr
+            else raise "DN badly formed"
+            end
+          when :value_quoted then
+            case char
+            when '\\' then state = :value_quoted_escape
+            when '"' then state = :value_end
+            else value << char
+            end
+          when :value_quoted_escape then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_quoted_escape_hex
+              hex_buffer = char
+            else
+              state = :value_quoted;
+              value << char
+            end
+          when :value_quoted_escape_hex then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_quoted
+              value << "#{hex_buffer}#{char}".to_i(16).chr
+            else raise "DN badly formed"
+            end
+          when :value_hexstring then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_hexstring_hex
+              value << char
+            when ' ' then state = :value_end
+            when ',' then
+              state = :key
+              yield key.string.strip, value.string.rstrip
+              key = StringIO.new
+              value = StringIO.new;
+            else raise "DN badly formed"
+            end
+          when :value_hexstring_hex then
+            case char
+            when '0'..'9', 'a'..'f', 'A'..'F' then
+              state = :value_hexstring
+              value << char
+            else raise "DN badly formed"
+            end
+          when :value_end then
+            case char
+            when ' ' then state = :value_end
+            when ',' then
+              state = :key
+              yield key.string.strip, value.string.rstrip
+              key = StringIO.new
+              value = StringIO.new;
+            else raise "DN badly formed"
+            end
+          else raise "Fell out of state machine"
+          end
         end
-      when :value_quoted_escape_hex then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_quoted
-          value << "#{hex_buffer}#{char}".to_i(16).chr
-        else raise "DN badly formed"
-        end
-      when :value_hexstring then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_hexstring_hex
-          value << char
-        when ' ' then state = :value_end
-        when ',' then
-          state = :key
-          yield key.string.strip, value.string.rstrip
-          key = StringIO.new
-          value = StringIO.new;
-        else raise "DN badly formed"
-        end
-      when :value_hexstring_hex then
-        case char
-        when '0'..'9', 'a'..'f', 'A'..'F' then
-          state = :value_hexstring
-          value << char
-        else raise "DN badly formed"
-        end
-      when :value_end then
-        case char
-        when ' ' then state = :value_end
-        when ',' then
-          state = :key
-          yield key.string.strip, value.string.rstrip
-          key = StringIO.new
-          value = StringIO.new;
-        else raise "DN badly formed"
-        end
-      else raise "Fell out of state machine"
-      end
-    end
 
-    # Last pair
-    raise "DN badly formed" unless
-      [:value, :value_normal, :value_hexstring, :value_end].include? state
+        # Last pair
+        raise "DN badly formed" unless
+          [:value, :value_normal, :value_hexstring, :value_end].include? state
 
-    yield key.string.strip, value.string.rstrip
-  end
+        yield key.string.strip, value.string.rstrip
+      end
 
-  ##
-  # Returns the DN as an array in the form expected by the constructor.
-  def to_a
-    a = []
-    self.each_pair { |key, value| a << key << value }
-    a
-  end
+      ##
+      # Returns the DN as an array in the form expected by the constructor.
+      def to_a
+        a = []
+        self.each_pair { |key, value| a << key << value }
+        a
+      end
 
-  ##
-  # Return the DN as an escaped string.
-  def to_s
-    @dn
-  end
+      ##
+      # Return the DN as an escaped string.
+      def to_s
+        @dn
+      end
 
-  # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
-  # for dn values. All of the following must be escaped in any normal string
-  # using a single backslash ('\') as escape.
-  ESCAPES = {
-    ','  => ',',
-    '+'  => '+',
-    '"'  => '"',
-    '\\' => '\\',
-    '<' => '<',
-    '>' => '>',
-    ';' => ';',
-  }
+      # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
+      # for dn values. All of the following must be escaped in any normal string
+      # using a single backslash ('\') as escape.
+      ESCAPES = {
+        ','  => ',',
+        '+'  => '+',
+        '"'  => '"',
+        '\\' => '\\',
+        '<' => '<',
+        '>' => '>',
+        ';' => ';',
+      }
 
-  # Compiled character class regexp using the keys from the above hash, and
-  # checking for a space or # at the start, or space at the end, of the
-  # string.
-  ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
-                         ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
-                         "])")
+      # Compiled character class regexp using the keys from the above hash, and
+      # checking for a space or # at the start, or space at the end, of the
+      # string.
+      ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
+                             ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                             "])")
 
-  ##
-  # Escape a string for use in a DN value
-  def self.escape(string)
-    string.gsub(ESCAPE_RE) { |char| "\\" + ESCAPES[char] }
-  end
+      ##
+      # Escape a string for use in a DN value
+      def self.escape(string)
+        string.gsub(ESCAPE_RE) { |char| "\\" + ESCAPES[char] }
+      end
 
-  ##
-  # Proxy all other requests to the string object, because a DN is mainly
-  # used within the library as a string
-  def method_missing(method, *args, &block)
-    @dn.send(method, *args, &block)
+      ##
+      # Proxy all other requests to the string object, because a DN is mainly
+      # used within the library as a string
+      def method_missing(method, *args, &block)
+        @dn.send(method, *args, &block)
+      end
+    end
   end
 end
-- 
cgit v1.2.1


From 91f2492a786bbe697b1f68e7b15090700a4c08a2 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 11:02:25 -0700
Subject: Add `DN#to_s_normalized`

---
 lib/gitlab/ldap/dn.rb           |  8 +++++-
 spec/lib/gitlab/ldap/dn_spec.rb | 55 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 spec/lib/gitlab/ldap/dn_spec.rb

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 038476b2d2a..0a49d5e4ca8 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -38,7 +38,7 @@ module Gitlab
           buffer << "," if index % 2 == 0 && index != 0
 
           if index < args.length - 1 || index % 2 == 1
-            buffer << Net::LDAP::DN.escape(args[index])
+            buffer << self.class.escape(args[index])
           else
             buffer << args[index]
           end
@@ -199,6 +199,12 @@ module Gitlab
         @dn
       end
 
+      ##
+      # Return the DN as an escaped and normalized string.
+      def to_s_normalized
+        self.class.new(*to_a).to_s
+      end
+
       # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
       # for dn values. All of the following must be escaped in any normal string
       # using a single backslash ('\') as escape.
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
new file mode 100644
index 00000000000..11711c905a1
--- /dev/null
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe Gitlab::LDAP::DN do
+  using RSpec::Parameterized::TableSyntax
+
+  describe '#initialize' do
+    subject { described_class.new(given).to_s_normalized }
+
+    # Regarding the telephoneNumber test:
+    #
+    # I am not sure whether a space after the telephoneNumber plus sign is valid,
+    # and I am not sure if this is "proper" behavior under these conditions, and
+    # I am not sure if it matters to us or anyone else, so rather than dig
+    # through RFCs, I am only documenting the behavior here.
+    where(:test_description, :given, :expected) do
+      'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
+      'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
+      'strips extraneous whitespace without changing escaped characters'                             | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
+      'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
+      'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+      'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
+      'does not strip an escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                     | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+      'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
+      'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
+      'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
+      'does not strip non whitespace'                                                                | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+      'does not treat escaped equal signs as attribute delimiters'                                   | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+      'does not treat escaped hex equal signs as attribute delimiters'                               | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
+      'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+      'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
+    end
+
+    with_them do
+      it 'normalizes the DN' do
+        assert_generic_test(test_description, subject, expected)
+      end
+    end
+
+    context 'when the given DN is malformed' do
+      let(:given) { 'uid\\=john' }
+
+      it 'raises MalformedDnError' do
+        expect(subject).to raise_error(MalformedDnError)
+      end
+    end
+  end
+
+  def assert_generic_test(test_description, got, expected)
+    test_failure_message = "Failed test description: '#{test_description}'\n\n    expected: #{expected}\n         got: #{got}"
+    expect(got).to eq(expected), test_failure_message
+  end
+end
-- 
cgit v1.2.1


From a0d7a22e7c1e8ae1a61b4ef24ef38180c68782c7 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 11:49:04 -0700
Subject: Always downcase DNs

---
 lib/gitlab/ldap/dn.rb | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 0a49d5e4ca8..555ef0b80ae 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -37,10 +37,12 @@ module Gitlab
           buffer << "=" if index % 2 == 1
           buffer << "," if index % 2 == 0 && index != 0
 
+          arg = args[index].downcase
+
           if index < args.length - 1 || index % 2 == 1
-            buffer << self.class.escape(args[index])
+            buffer << self.class.escape(arg)
           else
-            buffer << args[index]
+            buffer << arg
           end
         end
 
@@ -60,7 +62,7 @@ module Gitlab
           case state
           when :key then
             case char
-            when 'a'..'z', 'A'..'Z' then
+            when 'a'..'z' then
               state = :key_normal
               key << char
             when '0'..'9' then
@@ -72,7 +74,7 @@ module Gitlab
           when :key_normal then
             case char
             when '=' then state = :value
-            when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
+            when 'a'..'z', '0'..'9', '-', ' ' then key << char
             else raise "DN badly formed"
             end
           when :key_oid then
@@ -110,14 +112,14 @@ module Gitlab
             end
           when :value_normal_escape then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_normal_escape_hex
               hex_buffer = char
             else state = :value_normal; value << char
             end
           when :value_normal_escape_hex then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_normal
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise "DN badly formed"
@@ -130,7 +132,7 @@ module Gitlab
             end
           when :value_quoted_escape then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_quoted_escape_hex
               hex_buffer = char
             else
@@ -139,14 +141,14 @@ module Gitlab
             end
           when :value_quoted_escape_hex then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_quoted
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise "DN badly formed"
             end
           when :value_hexstring then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_hexstring_hex
               value << char
             when ' ' then state = :value_end
@@ -159,7 +161,7 @@ module Gitlab
             end
           when :value_hexstring_hex then
             case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
+            when '0'..'9', 'a'..'f' then
               state = :value_hexstring
               value << char
             else raise "DN badly formed"
-- 
cgit v1.2.1


From cb591f86e42a2f3bd4df2980cc4cfed0a0641e71 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 14:21:27 -0700
Subject: Fix to_s_normalize for escaped leading space

---
 lib/gitlab/ldap/dn.rb           | 14 +++-----------
 spec/lib/gitlab/ldap/dn_spec.rb |  2 +-
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 555ef0b80ae..02a4cbcd13a 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -210,27 +210,19 @@ module Gitlab
       # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
       # for dn values. All of the following must be escaped in any normal string
       # using a single backslash ('\') as escape.
-      ESCAPES = {
-        ','  => ',',
-        '+'  => '+',
-        '"'  => '"',
-        '\\' => '\\',
-        '<' => '<',
-        '>' => '>',
-        ';' => ';',
-      }
+      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';']
 
       # Compiled character class regexp using the keys from the above hash, and
       # checking for a space or # at the start, or space at the end, of the
       # string.
       ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
-                             ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                             NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
                              "])")
 
       ##
       # Escape a string for use in a DN value
       def self.escape(string)
-        string.gsub(ESCAPE_RE) { |char| "\\" + ESCAPES[char] }
+        string.gsub(ESCAPE_RE) { |char| "\\" + char }
       end
 
       ##
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 11711c905a1..73124bc4cc4 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -20,7 +20,7 @@ describe Gitlab::LDAP::DN do
       'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
       'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
-      'does not strip an escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                     | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
       'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
       'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
       'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
-- 
cgit v1.2.1


From 3fde6f6806dd86e3df4d08d55a63fed19f1dae55 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 14:41:42 -0700
Subject: Fix trailing escaped space

---
 lib/gitlab/ldap/dn.rb | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 02a4cbcd13a..c23fac2d57a 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -115,6 +115,7 @@ module Gitlab
             when '0'..'9', 'a'..'f' then
               state = :value_normal_escape_hex
               hex_buffer = char
+            when ' ' then state = :value_normal_escape_space; value << char
             else state = :value_normal; value << char
             end
           when :value_normal_escape_hex then
@@ -124,6 +125,16 @@ module Gitlab
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise "DN badly formed"
             end
+          when :value_normal_escape_space then
+            case char
+            when '\\' then state = :value_normal_escape
+            when ',' then
+              state = :key
+              yield key.string.strip, value.string # Don't strip trailing escaped space!
+              key = StringIO.new
+              value = StringIO.new;
+            else value << char
+            end
           when :value_quoted then
             case char
             when '\\' then state = :value_quoted_escape
-- 
cgit v1.2.1


From e65bf3fa63ae45aaf9600cffb50be58eee9023db Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 14:53:50 -0700
Subject: Clarify test

---
 spec/lib/gitlab/ldap/dn_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 73124bc4cc4..44e30a69d44 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -26,7 +26,7 @@ describe Gitlab::LDAP::DN do
       'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
       'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
       'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
-      'does not strip non whitespace'                                                                | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+      'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not treat escaped equal signs as attribute delimiters'                                   | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
       'does not treat escaped hex equal signs as attribute delimiters'                               | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
       'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
-- 
cgit v1.2.1


From c79879f33a05494f2ae5785a663b874bf8e42655 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:05:25 -0700
Subject: Fix escaped equal signs

---
 lib/gitlab/ldap/dn.rb           | 10 ++++++----
 spec/lib/gitlab/ldap/dn_spec.rb |  4 ++--
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index c23fac2d57a..554156142cc 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -218,10 +218,12 @@ module Gitlab
         self.class.new(*to_a).to_s
       end
 
-      # http://tools.ietf.org/html/rfc2253 section 2.4 lists these exceptions
-      # for dn values. All of the following must be escaped in any normal string
-      # using a single backslash ('\') as escape.
-      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';']
+      # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
+      # for DN values. All of the following must be escaped in any normal string
+      # using a single backslash ('\') as escape. The space character is left
+      # out here because in a "normalized" string, spaces should only be escaped
+      # if necessary (i.e. leading or trailing space).
+      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '=']
 
       # Compiled character class regexp using the keys from the above hash, and
       # checking for a space or # at the start, or space at the end, of the
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 44e30a69d44..dafc0037a0d 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -27,8 +27,8 @@ describe Gitlab::LDAP::DN do
       'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
       'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
       'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'does not treat escaped equal signs as attribute delimiters'                                   | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-      'does not treat escaped hex equal signs as attribute delimiters'                               | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
+      'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+      'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
       'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
       'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
     end
-- 
cgit v1.2.1


From f9283b8b18d59d749c803fc0a0b0d8ff1cccac02 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:07:26 -0700
Subject: Reword escaped comma test

---
 spec/lib/gitlab/ldap/dn_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index dafc0037a0d..f7c91cd0a1f 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -29,8 +29,8 @@ describe Gitlab::LDAP::DN do
       'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
       'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
-      'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
       'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
+      'does not modify an escaped comma in an attribute value'                                       | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
     end
 
     with_them do
-- 
cgit v1.2.1


From 1e7ff892c00eea4e26a653b7a13dee4330b49221 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:07:38 -0700
Subject: Fix escaped hex comma test

---
 spec/lib/gitlab/ldap/dn_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index f7c91cd0a1f..9c39a193f8b 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -29,8 +29,8 @@ describe Gitlab::LDAP::DN do
       'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
       'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
-      'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
       'does not modify an escaped comma in an attribute value'                                       | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+      'converts an escaped hex comma to an escaped comma in an attribute value'                      | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\, ca'
     end
 
     with_them do
-- 
cgit v1.2.1


From f610fea7771f09067c5ee76468d07e217794934e Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:25:30 -0700
Subject: Handle CR and LF characters

---
 lib/gitlab/ldap/dn.rb           | 13 ++++++++++++-
 spec/lib/gitlab/ldap/dn_spec.rb |  3 +++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 554156142cc..f62d36101c4 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -225,6 +225,12 @@ module Gitlab
       # if necessary (i.e. leading or trailing space).
       NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '=']
 
+      # The following must be represented as escaped hex
+      HEX_ESCAPES = {
+        "\n" => '\0a',
+        "\r" => '\0d'
+      }
+
       # Compiled character class regexp using the keys from the above hash, and
       # checking for a space or # at the start, or space at the end, of the
       # string.
@@ -232,10 +238,15 @@ module Gitlab
                              NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
                              "])")
 
+      HEX_ESCAPE_RE = Regexp.new("([" +
+                             HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                             "])")
+
       ##
       # Escape a string for use in a DN value
       def self.escape(string)
-        string.gsub(ESCAPE_RE) { |char| "\\" + char }
+        escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
+        escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
       end
 
       ##
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 9c39a193f8b..4b21b1b3f7a 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -31,6 +31,9 @@ describe Gitlab::LDAP::DN do
       'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
       'does not modify an escaped comma in an attribute value'                                       | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
       'converts an escaped hex comma to an escaped comma in an attribute value'                      | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\, ca'
+      'does not modify an escaped hex carriage return character in an attribute value'               | 'uid= John C. Smith, ou=San Francisco\\,\\0DCA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0dca'
+      'does not modify an escaped hex line feed character in an attribute value'                     | 'uid= John C. Smith, ou=San Francisco\\,\\0ACA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0aca'
+      'does not modify an escaped hex CRLF in an attribute value'                                    | 'uid= John C. Smith, ou=San Francisco\\,\\0D\\0ACA'                                                   | 'uid=john c. smith,ou=san francisco\\,\\0d\\0aca'
     end
 
     with_them do
-- 
cgit v1.2.1


From 7e3eb257babed7317a90e0ad62ca810108e28646 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:29:45 -0700
Subject: Fix for null DN

---
 lib/gitlab/ldap/dn.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index f62d36101c4..60e2ba96587 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -202,7 +202,7 @@ module Gitlab
       # Returns the DN as an array in the form expected by the constructor.
       def to_a
         a = []
-        self.each_pair { |key, value| a << key << value }
+        self.each_pair { |key, value| a << key << value } unless @dn.empty?
         a
       end
 
-- 
cgit v1.2.1


From 47dff608f4a06c54f243a26fb1412bef70df0844 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:42:35 -0700
Subject: Allow unescaped, non-reserved Unicode characters

---
 spec/lib/gitlab/ldap/dn_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 4b21b1b3f7a..a39aab91f8b 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -15,7 +15,7 @@ describe Gitlab::LDAP::DN do
     where(:test_description, :given, :expected) do
       'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
       'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-      'strips extraneous whitespace without changing escaped characters'                             | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
+      'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebastián c. smith  \\ ,ou=people (aka. \\"humans\\"),dc=example,dc=com'
       'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
       'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
       'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-- 
cgit v1.2.1


From 8bd59f3aeb614afb58152b033ba1020edae6c3a7 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 15:55:19 -0700
Subject: Raise UnsupportedDnFormatError on multivalued RDNs

---
 lib/gitlab/ldap/dn.rb           |  2 ++
 spec/lib/gitlab/ldap/dn_spec.rb | 32 ++++++++++++++++++++++++++++++--
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 60e2ba96587..234de1fe7eb 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -108,6 +108,7 @@ module Gitlab
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
               value = StringIO.new;
+            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
           when :value_normal_escape then
@@ -133,6 +134,7 @@ module Gitlab
               yield key.string.strip, value.string # Don't strip trailing escaped space!
               key = StringIO.new
               value = StringIO.new;
+            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
           when :value_quoted then
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index a39aab91f8b..6b197fa22fd 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -16,8 +16,6 @@ describe Gitlab::LDAP::DN do
       'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
       'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
       'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebastián c. smith  \\ ,ou=people (aka. \\"humans\\"),dc=example,dc=com'
-      'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
       'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
       'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
@@ -42,6 +40,36 @@ describe Gitlab::LDAP::DN do
       end
     end
 
+    context 'when we do not support the given DN format' do
+      context 'multivalued RDNs' do
+        context 'without extraneous whitespace' do
+          let(:given) { 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com' }
+
+          it 'raises UnsupportedDnFormatError' do
+            expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+          end
+        end
+
+        context 'with extraneous whitespace' do
+          context 'around the phone number plus sign' do
+            let(:given) { 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com' }
+
+            it 'raises UnsupportedDnFormatError' do
+              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            end
+          end
+
+          context 'not around the phone number plus sign' do
+            let(:given) { 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com' }
+
+            it 'raises UnsupportedDnFormatError' do
+              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            end
+          end
+        end
+      end
+    end
+
     context 'when the given DN is malformed' do
       let(:given) { 'uid\\=john' }
 
-- 
cgit v1.2.1


From 66030b03ddef0270a37e3d4eaaa5b871ff695d45 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 16:57:45 -0700
Subject: Test malformed DNs

---
 lib/gitlab/ldap/dn.rb           |  21 ++++----
 spec/lib/gitlab/ldap/dn_spec.rb | 106 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 114 insertions(+), 13 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 234de1fe7eb..048b669b13a 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -21,6 +21,9 @@
 # class also helps take care of that.
 module Gitlab
   module LDAP
+    MalformedDnError = Class.new(StandardError)
+    UnsupportedDnFormatError = Class.new(StandardError)
+
     class DN
       ##
       # Initialize a DN, escaping as required. Pass in attributes in name/value
@@ -69,19 +72,19 @@ module Gitlab
               state = :key_oid
               key << char
             when ' ' then state = :key
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
             end
           when :key_normal then
             case char
             when '=' then state = :value
             when 'a'..'z', '0'..'9', '-', ' ' then key << char
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
             end
           when :key_oid then
             case char
             when '=' then state = :value
             when '0'..'9', '.', ' ' then key << char
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
             end
           when :value then
             case char
@@ -124,7 +127,7 @@ module Gitlab
             when '0'..'9', 'a'..'f' then
               state = :value_normal
               value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
             end
           when :value_normal_escape_space then
             case char
@@ -157,7 +160,7 @@ module Gitlab
             when '0'..'9', 'a'..'f' then
               state = :value_quoted
               value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
             end
           when :value_hexstring then
             case char
@@ -170,14 +173,14 @@ module Gitlab
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
               value = StringIO.new;
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
             end
           when :value_hexstring_hex then
             case char
             when '0'..'9', 'a'..'f' then
               state = :value_hexstring
               value << char
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
             end
           when :value_end then
             case char
@@ -187,14 +190,14 @@ module Gitlab
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
               value = StringIO.new;
-            else raise "DN badly formed"
+            else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
             end
           else raise "Fell out of state machine"
           end
         end
 
         # Last pair
-        raise "DN badly formed" unless
+        raise(MalformedDnError, 'DN string ended unexpectedly') unless
           [:value, :value_normal, :value_hexstring, :value_end].include? state
 
         yield key.string.strip, value.string.rstrip
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 6b197fa22fd..d4fbe1c45ea 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -71,16 +71,114 @@ describe Gitlab::LDAP::DN do
     end
 
     context 'when the given DN is malformed' do
-      let(:given) { 'uid\\=john' }
+      context 'when ending with a comma' do
+        let(:given) { 'uid=John Smith,' }
 
-      it 'raises MalformedDnError' do
-        expect(subject).to raise_error(MalformedDnError)
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a space in it' do
+        let(:given) { '0.9.2342.19200300.100.1.25=#aa aa' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a non-hex character in it' do
+        let(:given) { '0.9.2342.19200300.100.1.25=#aaXaaa' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"x\"")
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a non-hex character in it' do
+        let(:given) { '0.9.2342.19200300.100.1.25=#aaaYaa' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"y\"")
+        end
+      end
+
+      context 'when given a hex pair with a non-hex character in it, inside double quotes' do
+        let(:given) { 'uid="Sebasti\\cX\\a1n"' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"x\"")
+        end
+      end
+
+      context 'without a name value pair' do
+        let(:given) { 'John' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'with an open (as opposed to closed) double quote' do
+        let(:given) { 'cn="James' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'with an invalid escaped hex code' do
+        let(:given) { 'cn=J\ames' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
+        end
+      end
+
+      context 'with a value ending with the escape character' do
+        let(:given) { 'cn=\\' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'with an invalid OID attribute type name' do
+        let(:given) { '1.2.d=Value' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN OID attribute type name character "d"')
+        end
+      end
+
+      context 'with a period in a non-OID attribute type name' do
+        let(:given) { 'd1.2=Value' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "."')
+        end
+      end
+
+      context 'when starting with non-space, non-alphanumeric character' do
+        let(:given) { ' -uid=John Smith' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized first character of an RDN attribute type name "-"')
+        end
+      end
+
+      context 'when given a UID with an escaped equal sign' do
+        let(:given) { 'uid\\=john' }
+
+        it 'raises MalformedDnError' do
+          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "\\"')
+        end
       end
     end
   end
 
   def assert_generic_test(test_description, got, expected)
-    test_failure_message = "Failed test description: '#{test_description}'\n\n    expected: #{expected}\n         got: #{got}"
+    test_failure_message = "Failed test description: '#{test_description}'\n\n    expected: \"#{expected}\"\n         got: \"#{got}\""
     expect(got).to eq(expected), test_failure_message
   end
 end
-- 
cgit v1.2.1


From 1480cf84d883552e952fdac834ad1da242b3dbcf Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 17:00:03 -0700
Subject: Add valid DN tests using OIDs

---
 spec/lib/gitlab/ldap/dn_spec.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index d4fbe1c45ea..1fd1aef1297 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -32,6 +32,8 @@ describe Gitlab::LDAP::DN do
       'does not modify an escaped hex carriage return character in an attribute value'               | 'uid= John C. Smith, ou=San Francisco\\,\\0DCA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0dca'
       'does not modify an escaped hex line feed character in an attribute value'                     | 'uid= John C. Smith, ou=San Francisco\\,\\0ACA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0aca'
       'does not modify an escaped hex CRLF in an attribute value'                                    | 'uid= John C. Smith, ou=San Francisco\\,\\0D\\0ACA'                                                   | 'uid=john c. smith,ou=san francisco\\,\\0d\\0aca'
+      'allows attribute type name OIDs'                                                              | '0.9.2342.19200300.100.1.25=Example,0.9.2342.19200300.100.1.25=Com'                                   | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
+      'strips extraneous whitespace from attribute type name OIDs'                                   | '0.9.2342.19200300.100.1.25 = Example, 0.9.2342.19200300.100.1.25 = Com'                              | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
     end
 
     with_them do
-- 
cgit v1.2.1


From 26054114be8136137c4b3740c82b51f49027eaab Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 17:16:57 -0700
Subject: Fix trailing escaped newline

---
 lib/gitlab/ldap/dn.rb           | 4 ++--
 spec/lib/gitlab/ldap/dn_spec.rb | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 048b669b13a..557b5af118e 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -119,7 +119,7 @@ module Gitlab
             when '0'..'9', 'a'..'f' then
               state = :value_normal_escape_hex
               hex_buffer = char
-            when ' ' then state = :value_normal_escape_space; value << char
+            when /\s/ then state = :value_normal_escape_whitespace; value << char
             else state = :value_normal; value << char
             end
           when :value_normal_escape_hex then
@@ -129,7 +129,7 @@ module Gitlab
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
             end
-          when :value_normal_escape_space then
+          when :value_normal_escape_whitespace then
             case char
             when '\\' then state = :value_normal_escape
             when ',' then
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 1fd1aef1297..8c268645346 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -21,9 +21,9 @@ describe Gitlab::LDAP::DN do
       'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
       'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
       'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
       'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
       'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
+      'hex-escapes and does not strip an escaped trailing newline in an attribute value'             | "uid=John Smith\\\n,ou=People,dc=example,dc=com"                                                      | "uid=john smith\\0a,ou=people,dc=example,dc=com"
       'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
       'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
-- 
cgit v1.2.1


From fe46c11de81e122433b1b275a1078840b289dfcd Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 17:17:38 -0700
Subject: Fix newline tests

---
 spec/lib/gitlab/ldap/dn_spec.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 8c268645346..a8687ec95d4 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -20,10 +20,10 @@ describe Gitlab::LDAP::DN do
       'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
       'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
       'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-      'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
+      'hex-escapes an escaped leading newline in an attribute value'                                 | "uid=\\\nJohn Smith,ou=People,dc=example,dc=com"                                                      | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
       'hex-escapes and does not strip an escaped trailing newline in an attribute value'             | "uid=John Smith\\\n,ou=People,dc=example,dc=com"                                                      | "uid=john smith\\0a,ou=people,dc=example,dc=com"
+      'hex-escapes an unescaped leading newline (actually an invalid DN?)'                           | "uid=\nJohn Smith,ou=People,dc=example,dc=com"                                                        | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
+      'strips an unescaped trailing newline (actually an invalid DN?)'                               | "uid=John Smith\n,ou=People,dc=example,dc=com"                                                        | "uid=john smith,ou=people,dc=example,dc=com"
       'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
       'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
-- 
cgit v1.2.1


From 45ab20dca91024602e7c73814e8ff89df2000189 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 20 Sep 2017 17:28:57 -0700
Subject: Switch to new DN class

for normalizing and parsing DNs
---
 lib/gitlab/ldap/auth_hash.rb        |  2 +-
 lib/gitlab/ldap/person.rb           | 17 +------------
 spec/lib/gitlab/ldap/person_spec.rb | 49 -------------------------------------
 spec/lib/gitlab/ldap/user_spec.rb   | 16 ++++++------
 4 files changed, 10 insertions(+), 74 deletions(-)

diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index 3123da17fd9..2ea0a51b18f 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -4,7 +4,7 @@ module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
       def uid
-        Gitlab::LDAP::Person.normalize_dn(super)
+        Gitlab::LDAP::DN.new(super).to_s_normalized
       end
 
       private
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 6b1a308d521..44cb6a065c9 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -49,21 +49,6 @@ module Gitlab
         uid
       end
 
-      # Returns the DN in a normalized form.
-      #
-      # 1. Excess spaces around attribute names and values are stripped
-      # 2. The string is downcased (for case-insensitivity)
-      def self.normalize_dn(dn)
-        dn.split(/(?<!\\)([,+=])/).map do |part|
-          normalize_dn_part(part)
-        end.join('')
-      rescue StandardError => e
-        Rails.logger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
-        Rails.logger.info(e.backtrace.join("\n"))
-
-        dn
-      end
-
       def initialize(entry, provider)
         Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
         @entry = entry
@@ -87,7 +72,7 @@ module Gitlab
       end
 
       def dn
-        self.class.normalize_dn(entry.dn)
+        DN.new(entry.dn).to_s_normalized
       end
 
       private
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 38458549751..02904f1e351 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -17,41 +17,6 @@ describe Gitlab::LDAP::Person do
     )
   end
 
-  shared_examples_for 'normalizes the DN' do
-    # Regarding the telephoneNumber test:
-    #
-    # I am not sure whether a space after the telephoneNumber plus sign is valid,
-    # and I am not sure if this is "proper" behavior under these conditions, and
-    # I am not sure if it matters to us or anyone else, so rather than dig
-    # through RFCs, I am only documenting the behavior here.
-    where(:test_description, :given, :expected) do
-      'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
-      'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-      'strips extraneous whitespace without changing escaped characters'                             | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebasti\\c3\\a1n\\ c.\\20smith\\ ,ou=people (aka. \\22humans\\"),dc=example,dc=com'
-      'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
-      'does not strip an escaped leading space in an attribute value (and does not error like Net::LDAP::DN.new does)' | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                     | 'uid=\\ john smith,ou=people,dc=example,dc=com'
-      'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-      'does not strip an escaped leading newline in an attribute value'                              | 'uid=\\\nJohn Smith,ou=People,dc=example,dc=com'                                                      | 'uid=\\\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip an escaped trailing newline in an attribute value'                             | 'uid=John Smith\\\n,ou=People,dc=example,dc=com'                                                      | 'uid=john smith\\\n,ou=people,dc=example,dc=com'
-      'does not strip an unescaped leading newline (actually an invalid DN)'                         | 'uid=\nJohn Smith,ou=People,dc=example,dc=com'                                                                               | 'uid=\njohn smith,ou=people,dc=example,dc=com'
-      'does not strip an unescaped trailing newline (actually an invalid DN)'                        | 'uid=John Smith\n ,ou=People,dc=example,dc=com'                                                                              | 'uid=john smith\n,ou=people,dc=example,dc=com'
-      'does not strip non whitespace'                                                                | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'does not treat escaped equal signs as attribute delimiters'                                   | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-      'does not treat escaped hex equal signs as attribute delimiters'                               | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\3d  bar'
-      'does not treat escaped commas as attribute delimiters'                                        | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
-      'does not treat escaped hex commas as attribute delimiters'                                    | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\2c ca'
-    end
-
-    with_them do
-      it 'normalizes the DN' do
-        assert_generic_test(test_description, subject, expected)
-      end
-    end
-  end
-
   shared_examples_for 'normalizes the UID' do
     where(:test_description, :given, :expected) do
       'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
@@ -91,20 +56,6 @@ describe Gitlab::LDAP::Person do
     end
   end
 
-  describe '.normalize_dn' do
-    subject { described_class.normalize_dn(given) }
-
-    it_behaves_like 'normalizes the DN'
-
-    context 'with an exception during normalization' do
-      let(:given) { described_class } # just something that will cause an exception
-
-      it 'returns the given DN unmodified' do
-        expect(subject).to eq(given)
-      end
-    end
-  end
-
   describe '#name' do
     it 'uses the configured name attribute and handles values as an array' do
       name = 'John Doe'
diff --git a/spec/lib/gitlab/ldap/user_spec.rb b/spec/lib/gitlab/ldap/user_spec.rb
index 6a6e465cea2..9a4705d1cee 100644
--- a/spec/lib/gitlab/ldap/user_spec.rb
+++ b/spec/lib/gitlab/ldap/user_spec.rb
@@ -11,7 +11,7 @@ describe Gitlab::LDAP::User do
     }
   end
   let(:auth_hash) do
-    OmniAuth::AuthHash.new(uid: 'my-uid', provider: 'ldapmain', info: info)
+    OmniAuth::AuthHash.new(uid: 'uid=John Smith,ou=People,dc=example,dc=com', provider: 'ldapmain', info: info)
   end
   let(:ldap_user_upper_case) { described_class.new(auth_hash_upper_case) }
   let(:info_upper_case) do
@@ -22,12 +22,12 @@ describe Gitlab::LDAP::User do
     }
   end
   let(:auth_hash_upper_case) do
-    OmniAuth::AuthHash.new(uid: 'my-uid', provider: 'ldapmain', info: info_upper_case)
+    OmniAuth::AuthHash.new(uid: 'uid=John Smith,ou=People,dc=example,dc=com', provider: 'ldapmain', info: info_upper_case)
   end
 
   describe '#changed?' do
     it "marks existing ldap user as changed" do
-      create(:omniauth_user, extern_uid: 'my-uid', provider: 'ldapmain')
+      create(:omniauth_user, extern_uid: 'uid=John Smith,ou=People,dc=example,dc=com', provider: 'ldapmain')
       expect(ldap_user.changed?).to be_truthy
     end
 
@@ -37,7 +37,7 @@ describe Gitlab::LDAP::User do
     end
 
     it "does not mark existing ldap user as changed" do
-      create(:omniauth_user, email: 'john@example.com', extern_uid: 'my-uid', provider: 'ldapmain')
+      create(:omniauth_user, email: 'john@example.com', extern_uid: 'uid=john smith,ou=people,dc=example,dc=com', provider: 'ldapmain')
       ldap_user.gl_user.user_synced_attributes_metadata(provider: 'ldapmain', email: true)
       expect(ldap_user.changed?).to be_falsey
     end
@@ -60,7 +60,7 @@ describe Gitlab::LDAP::User do
 
   describe 'find or create' do
     it "finds the user if already existing" do
-      create(:omniauth_user, extern_uid: 'my-uid', provider: 'ldapmain')
+      create(:omniauth_user, extern_uid: 'uid=John Smith,ou=People,dc=example,dc=com', provider: 'ldapmain')
 
       expect { ldap_user.save }.not_to change { User.count }
     end
@@ -70,7 +70,7 @@ describe Gitlab::LDAP::User do
       expect { ldap_user.save }.not_to change { User.count }
 
       existing_user.reload
-      expect(existing_user.ldap_identity.extern_uid).to eql 'my-uid'
+      expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
       expect(existing_user.ldap_identity.provider).to eql 'ldapmain'
     end
 
@@ -79,7 +79,7 @@ describe Gitlab::LDAP::User do
       expect { ldap_user.save }.not_to change { User.count }
 
       existing_user.reload
-      expect(existing_user.ldap_identity.extern_uid).to eql 'my-uid'
+      expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
       expect(existing_user.ldap_identity.provider).to eql 'ldapmain'
       expect(existing_user.id).to eql ldap_user.gl_user.id
     end
@@ -89,7 +89,7 @@ describe Gitlab::LDAP::User do
       expect { ldap_user_upper_case.save }.not_to change { User.count }
 
       existing_user.reload
-      expect(existing_user.ldap_identity.extern_uid).to eql 'my-uid'
+      expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
       expect(existing_user.ldap_identity.provider).to eql 'ldapmain'
       expect(existing_user.id).to eql ldap_user.gl_user.id
     end
-- 
cgit v1.2.1


From 14ed20d68af935da1a236d010978939a8085aa59 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Thu, 21 Sep 2017 09:42:16 -0700
Subject: Resolve Rubocop offenses

Disabling some for now since this is based on `Net::LDAP::DN`.
---
 lib/gitlab/ldap/dn.rb           | 42 ++++++++++++++++++++++++-----------------
 spec/lib/gitlab/ldap/dn_spec.rb | 32 +++++++++++++++----------------
 2 files changed, 41 insertions(+), 33 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 557b5af118e..05252c75624 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -37,16 +37,16 @@ module Gitlab
         buffer = StringIO.new
 
         args.each_index do |index|
-          buffer << "=" if index % 2 == 1
-          buffer << "," if index % 2 == 0 && index != 0
+          buffer << "=" if index.odd?
+          buffer << "," if index.even? && index != 0
 
           arg = args[index].downcase
 
-          if index < args.length - 1 || index % 2 == 1
-            buffer << self.class.escape(arg)
-          else
-            buffer << arg
-          end
+          buffer << if index < args.length - 1 || index.odd?
+                      self.class.escape(arg)
+                    else
+                      arg
+                    end
         end
 
         @dn = buffer.string
@@ -55,6 +55,9 @@ module Gitlab
       ##
       # Parse a DN into key value pairs using ASN from
       # http://tools.ietf.org/html/rfc2253 section 3.
+      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/PerceivedComplexity
       def each_pair
         state = :key
         key = StringIO.new
@@ -98,7 +101,7 @@ module Gitlab
               state = :key
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
-              value = StringIO.new;
+              value = StringIO.new
             else
               state = :value_normal
               value << char
@@ -110,7 +113,7 @@ module Gitlab
               state = :key
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
-              value = StringIO.new;
+              value = StringIO.new
             when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
@@ -119,8 +122,12 @@ module Gitlab
             when '0'..'9', 'a'..'f' then
               state = :value_normal_escape_hex
               hex_buffer = char
-            when /\s/ then state = :value_normal_escape_whitespace; value << char
-            else state = :value_normal; value << char
+            when /\s/ then
+              state = :value_normal_escape_whitespace
+              value << char
+            else
+              state = :value_normal
+              value << char
             end
           when :value_normal_escape_hex then
             case char
@@ -136,7 +143,7 @@ module Gitlab
               state = :key
               yield key.string.strip, value.string # Don't strip trailing escaped space!
               key = StringIO.new
-              value = StringIO.new;
+              value = StringIO.new
             when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
@@ -152,7 +159,7 @@ module Gitlab
               state = :value_quoted_escape_hex
               hex_buffer = char
             else
-              state = :value_quoted;
+              state = :value_quoted
               value << char
             end
           when :value_quoted_escape_hex then
@@ -172,7 +179,7 @@ module Gitlab
               state = :key
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
-              value = StringIO.new;
+              value = StringIO.new
             else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
             end
           when :value_hexstring_hex then
@@ -189,7 +196,7 @@ module Gitlab
               state = :key
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
-              value = StringIO.new;
+              value = StringIO.new
             else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
             end
           else raise "Fell out of state machine"
@@ -228,13 +235,13 @@ module Gitlab
       # using a single backslash ('\') as escape. The space character is left
       # out here because in a "normalized" string, spaces should only be escaped
       # if necessary (i.e. leading or trailing space).
-      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '=']
+      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
 
       # The following must be represented as escaped hex
       HEX_ESCAPES = {
         "\n" => '\0a',
         "\r" => '\0d'
-      }
+      }.freeze
 
       # Compiled character class regexp using the keys from the above hash, and
       # checking for a space or # at the start, or space at the end, of the
@@ -257,6 +264,7 @@ module Gitlab
       ##
       # Proxy all other requests to the string object, because a DN is mainly
       # used within the library as a string
+      # rubocop:disable GitlabSecurity/PublicSend
       def method_missing(method, *args, &block)
         @dn.send(method, *args, &block)
       end
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index a8687ec95d4..f923c67d922 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -48,7 +48,7 @@ describe Gitlab::LDAP::DN do
           let(:given) { 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com' }
 
           it 'raises UnsupportedDnFormatError' do
-            expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
           end
         end
 
@@ -57,7 +57,7 @@ describe Gitlab::LDAP::DN do
             let(:given) { 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com' }
 
             it 'raises UnsupportedDnFormatError' do
-              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+              expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
             end
           end
 
@@ -65,7 +65,7 @@ describe Gitlab::LDAP::DN do
             let(:given) { 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com' }
 
             it 'raises UnsupportedDnFormatError' do
-              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+              expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
             end
           end
         end
@@ -77,7 +77,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid=John Smith,' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
         end
       end
 
@@ -85,7 +85,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aa aa' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
         end
       end
 
@@ -93,7 +93,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaXaaa' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"x\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"x\"")
         end
       end
 
@@ -101,7 +101,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaaYaa' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"y\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"y\"")
         end
       end
 
@@ -109,7 +109,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid="Sebasti\\cX\\a1n"' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"x\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"x\"")
         end
       end
 
@@ -117,7 +117,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'John' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
         end
       end
 
@@ -125,7 +125,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn="James' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
         end
       end
 
@@ -133,7 +133,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn=J\ames' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
         end
       end
 
@@ -141,7 +141,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn=\\' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
         end
       end
 
@@ -149,7 +149,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '1.2.d=Value' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN OID attribute type name character "d"')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN OID attribute type name character "d"')
         end
       end
 
@@ -157,7 +157,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'd1.2=Value' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "."')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "."')
         end
       end
 
@@ -165,7 +165,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { ' -uid=John Smith' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized first character of an RDN attribute type name "-"')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized first character of an RDN attribute type name "-"')
         end
       end
 
@@ -173,7 +173,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid\\=john' }
 
         it 'raises MalformedDnError' do
-          expect{ subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "\\"')
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "\\"')
         end
       end
     end
-- 
cgit v1.2.1


From e610332edacd2e389bcaec5931d8bcdccd8a92cc Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Thu, 21 Sep 2017 10:32:21 -0700
Subject: Normalize existing persisted DNs

---
 .../20170921101004_normalize_ldap_extern_uids.rb   | 285 +++++++++++++++++++++
 1 file changed, 285 insertions(+)
 create mode 100644 db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb

diff --git a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
new file mode 100644
index 00000000000..501ba7c5fe2
--- /dev/null
+++ b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
@@ -0,0 +1,285 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class NormalizeLdapExternUids < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  class Identity < ActiveRecord::Base
+    self.table_name = 'identities'
+  end
+
+  # Copied this class to make this migration resilient to future code changes.
+  # And if the normalize behavior is changed in the future, it must be
+  # accompanied by another migration.
+  module Gitlab
+    module LDAP
+      MalformedDnError = Class.new(StandardError)
+      UnsupportedDnFormatError = Class.new(StandardError)
+
+      class DN
+        ##
+        # Initialize a DN, escaping as required. Pass in attributes in name/value
+        # pairs. If there is a left over argument, it will be appended to the dn
+        # without escaping (useful for a base string).
+        #
+        # Most uses of this class will be to escape a DN, rather than to parse it,
+        # so storing the dn as an escaped String and parsing parts as required
+        # with a state machine seems sensible.
+        def initialize(*args)
+          buffer = StringIO.new
+
+          args.each_index do |index|
+            buffer << "=" if index.odd?
+            buffer << "," if index.even? && index != 0
+
+            arg = args[index].downcase
+
+            buffer << if index < args.length - 1 || index.odd?
+                        self.class.escape(arg)
+                      else
+                        arg
+                      end
+          end
+
+          @dn = buffer.string
+        end
+
+        ##
+        # Parse a DN into key value pairs using ASN from
+        # http://tools.ietf.org/html/rfc2253 section 3.
+        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable Metrics/PerceivedComplexity
+        def each_pair
+          state = :key
+          key = StringIO.new
+          value = StringIO.new
+          hex_buffer = ""
+
+          @dn.each_char do |char|
+            case state
+            when :key then
+              case char
+              when 'a'..'z' then
+                state = :key_normal
+                key << char
+              when '0'..'9' then
+                state = :key_oid
+                key << char
+              when ' ' then state = :key
+              else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
+              end
+            when :key_normal then
+              case char
+              when '=' then state = :value
+              when 'a'..'z', '0'..'9', '-', ' ' then key << char
+              else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
+              end
+            when :key_oid then
+              case char
+              when '=' then state = :value
+              when '0'..'9', '.', ' ' then key << char
+              else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
+              end
+            when :value then
+              case char
+              when '\\' then state = :value_normal_escape
+              when '"' then state = :value_quoted
+              when ' ' then state = :value
+              when '#' then
+                state = :value_hexstring
+                value << char
+              when ',' then
+                state = :key
+                yield key.string.strip, value.string.rstrip
+                key = StringIO.new
+                value = StringIO.new
+              else
+                state = :value_normal
+                value << char
+              end
+            when :value_normal then
+              case char
+              when '\\' then state = :value_normal_escape
+              when ',' then
+                state = :key
+                yield key.string.strip, value.string.rstrip
+                key = StringIO.new
+                value = StringIO.new
+              when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
+              else value << char
+              end
+            when :value_normal_escape then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_normal_escape_hex
+                hex_buffer = char
+              when /\s/ then
+                state = :value_normal_escape_whitespace
+                value << char
+              else
+                state = :value_normal
+                value << char
+              end
+            when :value_normal_escape_hex then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_normal
+                value << "#{hex_buffer}#{char}".to_i(16).chr
+              else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
+              end
+            when :value_normal_escape_whitespace then
+              case char
+              when '\\' then state = :value_normal_escape
+              when ',' then
+                state = :key
+                yield key.string.strip, value.string # Don't strip trailing escaped space!
+                key = StringIO.new
+                value = StringIO.new
+              when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
+              else value << char
+              end
+            when :value_quoted then
+              case char
+              when '\\' then state = :value_quoted_escape
+              when '"' then state = :value_end
+              else value << char
+              end
+            when :value_quoted_escape then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_quoted_escape_hex
+                hex_buffer = char
+              else
+                state = :value_quoted
+                value << char
+              end
+            when :value_quoted_escape_hex then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_quoted
+                value << "#{hex_buffer}#{char}".to_i(16).chr
+              else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
+              end
+            when :value_hexstring then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_hexstring_hex
+                value << char
+              when ' ' then state = :value_end
+              when ',' then
+                state = :key
+                yield key.string.strip, value.string.rstrip
+                key = StringIO.new
+                value = StringIO.new
+              else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
+              end
+            when :value_hexstring_hex then
+              case char
+              when '0'..'9', 'a'..'f' then
+                state = :value_hexstring
+                value << char
+              else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
+              end
+            when :value_end then
+              case char
+              when ' ' then state = :value_end
+              when ',' then
+                state = :key
+                yield key.string.strip, value.string.rstrip
+                key = StringIO.new
+                value = StringIO.new
+              else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
+              end
+            else raise "Fell out of state machine"
+            end
+          end
+
+          # Last pair
+          raise(MalformedDnError, 'DN string ended unexpectedly') unless
+            [:value, :value_normal, :value_hexstring, :value_end].include? state
+
+          yield key.string.strip, value.string.rstrip
+        end
+
+        ##
+        # Returns the DN as an array in the form expected by the constructor.
+        def to_a
+          a = []
+          self.each_pair { |key, value| a << key << value } unless @dn.empty?
+          a
+        end
+
+        ##
+        # Return the DN as an escaped string.
+        def to_s
+          @dn
+        end
+
+        ##
+        # Return the DN as an escaped and normalized string.
+        def to_s_normalized
+          self.class.new(*to_a).to_s
+        end
+
+        # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
+        # for DN values. All of the following must be escaped in any normal string
+        # using a single backslash ('\') as escape. The space character is left
+        # out here because in a "normalized" string, spaces should only be escaped
+        # if necessary (i.e. leading or trailing space).
+        NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
+
+        # The following must be represented as escaped hex
+        HEX_ESCAPES = {
+          "\n" => '\0a',
+          "\r" => '\0d'
+        }.freeze
+
+        # Compiled character class regexp using the keys from the above hash, and
+        # checking for a space or # at the start, or space at the end, of the
+        # string.
+        ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
+                               NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
+                               "])")
+
+        HEX_ESCAPE_RE = Regexp.new("([" +
+                               HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                               "])")
+
+        ##
+        # Escape a string for use in a DN value
+        def self.escape(string)
+          escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
+          escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
+        end
+
+        ##
+        # Proxy all other requests to the string object, because a DN is mainly
+        # used within the library as a string
+        # rubocop:disable GitlabSecurity/PublicSend
+        def method_missing(method, *args, &block)
+          @dn.send(method, *args, &block)
+        end
+      end
+    end
+  end
+
+  def up
+    ldap_identities = Identity.where("provider like 'ldap%'")
+    ldap_identities.find_each do |identity|
+      begin
+        identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_s_normalized
+        unless identity.save
+          say "Unable to normalize \"#{identity.extern_uid}\". Skipping."
+        end
+      rescue Gitlab::LDAP::MalformedDnError, Gitlab::LDAP::UnsupportedDnFormatError => e
+        say "Unable to normalize \"#{identity.extern_uid}\" due to \"#{e.message}\". Skipping."
+      end
+    end
+  end
+
+  def down
+  end
+end
-- 
cgit v1.2.1


From b3d61832c37b037f95dad619dd8c0680b6513818 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 2 Oct 2017 13:24:20 -0700
Subject: Move downcasing to normalize method

---
 lib/gitlab/ldap/dn.rb           | 20 ++++++++++----------
 spec/lib/gitlab/ldap/dn_spec.rb |  8 ++++----
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 05252c75624..3766893ff6d 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -40,7 +40,7 @@ module Gitlab
           buffer << "=" if index.odd?
           buffer << "," if index.even? && index != 0
 
-          arg = args[index].downcase
+          arg = args[index]
 
           buffer << if index < args.length - 1 || index.odd?
                       self.class.escape(arg)
@@ -68,7 +68,7 @@ module Gitlab
           case state
           when :key then
             case char
-            when 'a'..'z' then
+            when 'a'..'z', 'A'..'Z' then
               state = :key_normal
               key << char
             when '0'..'9' then
@@ -80,7 +80,7 @@ module Gitlab
           when :key_normal then
             case char
             when '=' then state = :value
-            when 'a'..'z', '0'..'9', '-', ' ' then key << char
+            when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
             else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
             end
           when :key_oid then
@@ -119,7 +119,7 @@ module Gitlab
             end
           when :value_normal_escape then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_normal_escape_hex
               hex_buffer = char
             when /\s/ then
@@ -131,7 +131,7 @@ module Gitlab
             end
           when :value_normal_escape_hex then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_normal
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
@@ -155,7 +155,7 @@ module Gitlab
             end
           when :value_quoted_escape then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_quoted_escape_hex
               hex_buffer = char
             else
@@ -164,14 +164,14 @@ module Gitlab
             end
           when :value_quoted_escape_hex then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_quoted
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
             end
           when :value_hexstring then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_hexstring_hex
               value << char
             when ' ' then state = :value_end
@@ -184,7 +184,7 @@ module Gitlab
             end
           when :value_hexstring_hex then
             case char
-            when '0'..'9', 'a'..'f' then
+            when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_hexstring
               value << char
             else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
@@ -227,7 +227,7 @@ module Gitlab
       ##
       # Return the DN as an escaped and normalized string.
       def to_s_normalized
-        self.class.new(*to_a).to_s
+        self.class.new(*to_a).to_s.downcase
       end
 
       # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index f923c67d922..67a561854aa 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Gitlab::LDAP::DN do
   using RSpec::Parameterized::TableSyntax
 
-  describe '#initialize' do
+  describe '#to_s_normalized' do
     subject { described_class.new(given).to_s_normalized }
 
     # Regarding the telephoneNumber test:
@@ -93,7 +93,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaXaaa' }
 
         it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"x\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"X\"")
         end
       end
 
@@ -101,7 +101,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaaYaa' }
 
         it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"y\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"Y\"")
         end
       end
 
@@ -109,7 +109,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid="Sebasti\\cX\\a1n"' }
 
         it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"x\"")
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
         end
       end
 
-- 
cgit v1.2.1


From a6a764f73debb41005fbfe7e902c9f51e2bbcff1 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 2 Oct 2017 14:57:57 -0700
Subject: Refactor initialize method for clarity

---
 lib/gitlab/ldap/dn.rb | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 3766893ff6d..060f61d1a10 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -34,24 +34,33 @@ module Gitlab
       # so storing the dn as an escaped String and parsing parts as required
       # with a state machine seems sensible.
       def initialize(*args)
-        buffer = StringIO.new
-
-        args.each_index do |index|
-          buffer << "=" if index.odd?
-          buffer << "," if index.even? && index != 0
+        if args.length > 1
+          initialize_array(args)
+        else
+          initialize_string(args[0])
+        end
+      end
 
-          arg = args[index]
+      def initialize_array(args)
+        buffer = StringIO.new
 
-          buffer << if index < args.length - 1 || index.odd?
-                      self.class.escape(arg)
-                    else
-                      arg
-                    end
+        args.each_with_index do |arg, index|
+          if index.even? # key
+            buffer << "," if index > 0
+            buffer << arg
+          else # value
+            buffer << "="
+            buffer << self.class.escape(arg)
+          end
         end
 
         @dn = buffer.string
       end
 
+      def initialize_string(arg)
+        @dn = arg.to_s
+      end
+
       ##
       # Parse a DN into key value pairs using ASN from
       # http://tools.ietf.org/html/rfc2253 section 3.
-- 
cgit v1.2.1


From 714f264d62c5d2a45efc4b013f2fca1eb7eff1f1 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 2 Oct 2017 15:00:50 -0700
Subject: Rename method to `to_normalized_s`

---
 db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb | 4 ++--
 lib/gitlab/ldap/auth_hash.rb                                 | 2 +-
 lib/gitlab/ldap/dn.rb                                        | 2 +-
 lib/gitlab/ldap/person.rb                                    | 2 +-
 spec/lib/gitlab/ldap/dn_spec.rb                              | 4 ++--
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
index 501ba7c5fe2..aa95fa49e48 100644
--- a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
+++ b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
@@ -220,7 +220,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
 
         ##
         # Return the DN as an escaped and normalized string.
-        def to_s_normalized
+        def to_normalized_s
           self.class.new(*to_a).to_s
         end
 
@@ -270,7 +270,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
     ldap_identities = Identity.where("provider like 'ldap%'")
     ldap_identities.find_each do |identity|
       begin
-        identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_s_normalized
+        identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_normalized_s
         unless identity.save
           say "Unable to normalize \"#{identity.extern_uid}\". Skipping."
         end
diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index 2ea0a51b18f..b173b879f5f 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -4,7 +4,7 @@ module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
       def uid
-        Gitlab::LDAP::DN.new(super).to_s_normalized
+        Gitlab::LDAP::DN.new(super).to_normalized_s
       end
 
       private
diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 060f61d1a10..4ecb5566018 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -235,7 +235,7 @@ module Gitlab
 
       ##
       # Return the DN as an escaped and normalized string.
-      def to_s_normalized
+      def to_normalized_s
         self.class.new(*to_a).to_s.downcase
       end
 
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 44cb6a065c9..af8aab2444b 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -72,7 +72,7 @@ module Gitlab
       end
 
       def dn
-        DN.new(entry.dn).to_s_normalized
+        DN.new(entry.dn).to_normalized_s
       end
 
       private
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 67a561854aa..9a1963e2194 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -3,8 +3,8 @@ require 'spec_helper'
 describe Gitlab::LDAP::DN do
   using RSpec::Parameterized::TableSyntax
 
-  describe '#to_s_normalized' do
-    subject { described_class.new(given).to_s_normalized }
+  describe '#to_normalized_s' do
+    subject { described_class.new(given).to_normalized_s }
 
     # Regarding the telephoneNumber test:
     #
-- 
cgit v1.2.1


From 689eea5a43a79cd7fcbb8d579abaf37a81fc267a Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 3 Oct 2017 13:55:46 -0700
Subject: Fix space stripping

Especially from the last attribute value.
---
 lib/gitlab/ldap/dn.rb           | 44 ++++++++++++++++++++++-------------------
 spec/lib/gitlab/ldap/dn_spec.rb |  8 +++++++-
 2 files changed, 31 insertions(+), 21 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 4ecb5566018..751219b7334 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -73,7 +73,7 @@ module Gitlab
         value = StringIO.new
         hex_buffer = ""
 
-        @dn.each_char do |char|
+        @dn.each_char.with_index do |char, dn_index|
           case state
           when :key then
             case char
@@ -108,7 +108,7 @@ module Gitlab
               value << char
             when ',' then
               state = :key
-              yield key.string.strip, value.string.rstrip
+              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
             else
@@ -120,7 +120,7 @@ module Gitlab
             when '\\' then state = :value_normal_escape
             when ',' then
               state = :key
-              yield key.string.strip, value.string.rstrip
+              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
             when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
@@ -131,9 +131,6 @@ module Gitlab
             when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_normal_escape_hex
               hex_buffer = char
-            when /\s/ then
-              state = :value_normal_escape_whitespace
-              value << char
             else
               state = :value_normal
               value << char
@@ -145,17 +142,6 @@ module Gitlab
               value << "#{hex_buffer}#{char}".to_i(16).chr
             else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
             end
-          when :value_normal_escape_whitespace then
-            case char
-            when '\\' then state = :value_normal_escape
-            when ',' then
-              state = :key
-              yield key.string.strip, value.string # Don't strip trailing escaped space!
-              key = StringIO.new
-              value = StringIO.new
-            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
-            else value << char
-            end
           when :value_quoted then
             case char
             when '\\' then state = :value_quoted_escape
@@ -186,7 +172,7 @@ module Gitlab
             when ' ' then state = :value_end
             when ',' then
               state = :key
-              yield key.string.strip, value.string.rstrip
+              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
             else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
@@ -203,7 +189,7 @@ module Gitlab
             when ' ' then state = :value_end
             when ',' then
               state = :key
-              yield key.string.strip, value.string.rstrip
+              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
             else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
@@ -216,7 +202,25 @@ module Gitlab
         raise(MalformedDnError, 'DN string ended unexpectedly') unless
           [:value, :value_normal, :value_hexstring, :value_end].include? state
 
-        yield key.string.strip, value.string.rstrip
+        yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
+      end
+
+      def rstrip_except_escaped(str, dn_index)
+        str_ends_with_whitespace = str.match(/\s\z/)
+
+        if str_ends_with_whitespace
+          dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
+
+          if dn_part_ends_with_escaped_whitespace
+            dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
+            num_chars_to_remove = dn_part_rwhitespace.length - 1
+            str = str[0, str.length - num_chars_to_remove]
+          else
+            str.rstrip!
+          end
+        end
+
+        str
       end
 
       ##
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 9a1963e2194..9a8ef7721ef 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -15,11 +15,17 @@ describe Gitlab::LDAP::DN do
     where(:test_description, :given, :expected) do
       'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
       'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-      'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebastián c. smith  \\ ,ou=people (aka. \\"humans\\"),dc=example,dc=com'
+      'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'      | 'uid=sebastián c. smith,ou=people (aka. \\"humans\\"),dc=example,dc=com'
       'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
       'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+      'does not strip an escaped leading space in the last attribute value'                          | 'uid=\\ John Smith'                                                                                   | 'uid=\\ john smith'
       'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+      'strips extraneous spaces after an escaped trailing space'                                     | 'uid=John Smith\\   ,ou=People,dc=example,dc=com'                                                     | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+      'strips extraneous spaces after an escaped trailing space at the end of the DN'                | 'uid=John Smith,ou=People,dc=example,dc=com\\   '                                                     | 'uid=john smith,ou=people,dc=example,dc=com\\ '
+      'properly preserves escaped trailing space after unescaped trailing spaces'                    | 'uid=John Smith  \\  ,ou=People,dc=example,dc=com'                                                    | 'uid=john smith  \\ ,ou=people,dc=example,dc=com'
+      'preserves multiple inner spaces in an attribute value'                                        | 'uid=John   Smith,ou=People,dc=example,dc=com'                                                        | 'uid=john   smith,ou=people,dc=example,dc=com'
+      'preserves inner spaces after an escaped space'                                                | 'uid=John\\   Smith,ou=People,dc=example,dc=com'                                                      | 'uid=john   smith,ou=people,dc=example,dc=com'
       'hex-escapes an escaped leading newline in an attribute value'                                 | "uid=\\\nJohn Smith,ou=People,dc=example,dc=com"                                                      | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
       'hex-escapes and does not strip an escaped trailing newline in an attribute value'             | "uid=John Smith\\\n,ou=People,dc=example,dc=com"                                                      | "uid=john smith\\0a,ou=people,dc=example,dc=com"
       'hex-escapes an unescaped leading newline (actually an invalid DN?)'                           | "uid=\nJohn Smith,ou=People,dc=example,dc=com"                                                        | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
-- 
cgit v1.2.1


From ed07faf2847f5adaebbd65d81d423fd249f9b542 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 3 Oct 2017 13:56:51 -0700
Subject: Remove telephoneNumber format comment

Since that behavior changed, and is now under the malformed DN context.
---
 spec/lib/gitlab/ldap/dn_spec.rb | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 9a8ef7721ef..725a1324109 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -6,12 +6,6 @@ describe Gitlab::LDAP::DN do
   describe '#to_normalized_s' do
     subject { described_class.new(given).to_normalized_s }
 
-    # Regarding the telephoneNumber test:
-    #
-    # I am not sure whether a space after the telephoneNumber plus sign is valid,
-    # and I am not sure if this is "proper" behavior under these conditions, and
-    # I am not sure if it matters to us or anyone else, so rather than dig
-    # through RFCs, I am only documenting the behavior here.
     where(:test_description, :given, :expected) do
       'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
       'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-- 
cgit v1.2.1


From 6b9229466dc84d3d2b4ed002807d28960bfd1a84 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 3 Oct 2017 14:38:55 -0700
Subject: Normalize values, reusing DN normalization code

I first attempted to extract logic from the code that normalizes DNs, but I was unsuccessful. This is a hack but it works.
---
 lib/gitlab/ldap/dn.rb                |  6 +++
 lib/gitlab/ldap/person.rb            | 35 +-----------------
 spec/lib/gitlab/ldap/dn_spec.rb      | 72 ++++++++++++++++++++++++++++++++++++
 spec/lib/gitlab/ldap/person_spec.rb  | 30 +--------------
 spec/support/ldap_shared_examples.rb | 29 +++++++++++++++
 5 files changed, 111 insertions(+), 61 deletions(-)
 create mode 100644 spec/support/ldap_shared_examples.rb

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 751219b7334..87a7f1c6bc0 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -25,6 +25,12 @@ module Gitlab
     UnsupportedDnFormatError = Class.new(StandardError)
 
     class DN
+      def self.normalize_value(given_value)
+        dummy_dn = "placeholder=#{given_value}"
+        normalized_dn = new(*dummy_dn).to_normalized_s
+        normalized_dn.sub(/\Aplaceholder=/, '')
+      end
+
       ##
       # Initialize a DN, escaping as required. Pass in attributes in name/value
       # pairs. If there is a left over argument, it will be appended to the dn
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index af8aab2444b..e91e3a176e6 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -41,8 +41,8 @@ module Gitlab
       # 1. Excess spaces are stripped
       # 2. The string is downcased (for case-insensitivity)
       def self.normalize_uid(uid)
-        normalize_dn_part(uid)
-      rescue StandardError => e
+        ::Gitlab::LDAP::DN.normalize_value(uid)
+      rescue ::Gitlab::LDAP::MalformedDnError, ::Gitlab::LDAP::UnsupportedDnFormatError => e
         Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
         Rails.logger.info(e.backtrace.join("\n"))
 
@@ -77,37 +77,6 @@ module Gitlab
 
       private
 
-      def self.normalize_dn_part(part)
-        cleaned = part.strip.downcase
-
-        if cleaned.ends_with?('\\')
-          # If it ends with an escape character that is not followed by a
-          # character to be escaped, then this part may be malformed. But let's
-          # not worry too much about it, and just return it unmodified.
-          #
-          # Why? Because the reason we clean DNs is to make our simplistic
-          # string comparisons work better, even though there are all kinds of
-          # ways that equivalent DNs can vary as strings. If we run into a
-          # strange DN, we should just try to work with it.
-          #
-          # See https://www.ldap.com/ldap-dns-and-rdns for more.
-          return part unless part.ends_with?(' ')
-
-          # Ends with an escaped space (which is valid).
-          cleaned = cleaned + ' '
-        end
-
-        # Get rid of blanks. This can happen if a split character is followed by
-        # whitespace and then another split character.
-        #
-        # E.g. this DN: 'uid=john+telephoneNumber= +1 555-555-5555'
-        #
-        # Should be returned as: 'uid=john+telephoneNumber=+1 555-555-5555'
-        cleaned = '' if cleaned.blank?
-
-        cleaned
-      end
-
       def entry
         @entry
       end
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 725a1324109..709eadd7e38 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -3,6 +3,78 @@ require 'spec_helper'
 describe Gitlab::LDAP::DN do
   using RSpec::Parameterized::TableSyntax
 
+  describe '#normalize_value' do
+    subject { described_class.normalize_value(given) }
+
+    it_behaves_like 'normalizes a DN attribute value'
+
+    context 'when the given DN is malformed' do
+      context 'when ending with a comma' do
+        let(:given) { 'John Smith,' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a space in it' do
+        let(:given) { '#aa aa' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a non-hex character in it' do
+        let(:given) { '#aaXaaa' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"X\"")
+        end
+      end
+
+      context 'when given a BER encoded attribute value with a non-hex character in it' do
+        let(:given) { '#aaaYaa' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"Y\"")
+        end
+      end
+
+      context 'when given a hex pair with a non-hex character in it, inside double quotes' do
+        let(:given) { '"Sebasti\\cX\\a1n"' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
+        end
+      end
+
+      context 'with an open (as opposed to closed) double quote' do
+        let(:given) { '"James' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+
+      context 'with an invalid escaped hex code' do
+        let(:given) { 'J\ames' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
+        end
+      end
+
+      context 'with a value ending with the escape character' do
+        let(:given) { 'foo\\' }
+
+        it 'raises MalformedDnError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        end
+      end
+    end
+  end
+
   describe '#to_normalized_s' do
     subject { described_class.new(given).to_normalized_s }
 
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 02904f1e351..743b3fbde2b 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -1,7 +1,6 @@
 require 'spec_helper'
 
 describe Gitlab::LDAP::Person do
-  using RSpec::Parameterized::TableSyntax
   include LdapHelpers
 
   let(:entry) { ldap_user_entry('john.doe') }
@@ -17,38 +16,13 @@ describe Gitlab::LDAP::Person do
     )
   end
 
-  shared_examples_for 'normalizes the UID' do
-    where(:test_description, :given, :expected) do
-      'strips extraneous whitespace'                                        | ' John C. Smith   '                     | 'john c. smith'
-      'strips extraneous whitespace without changing escaped characters'    | '  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ' | 'sebasti\\c3\\a1n\\ c.\\20smith\\ '
-      'downcases the whole string'                                          | 'John Smith'                            | 'john smith'
-      'does not strip the escaped leading space in an attribute value'      | '   \\ John Smith '                     | '\\ john smith'
-      'does not strip the escaped trailing space in an attribute value'     | '    John Smith\\   '                   | 'john smith\\ '
-      'does not strip the escaped leading newline in an attribute value'    | '     \\\nJohn Smith  '                 | '\\\njohn smith'
-      'does not strip the escaped trailing newline in an attribute value'   | '    John Smith\\\n  '                  | 'john smith\\\n'
-      'does not strip the unescaped leading newline in an attribute value'  | '   \nJohn Smith '                      | '\njohn smith'
-      'does not strip the unescaped trailing newline in an attribute value' | '  John Smith\n   '                     | 'john smith\n'
-      'does not strip non whitespace'                                       | 'John Smith'                            | 'john smith'
-      'does not treat escaped equal signs as attribute delimiters'          | ' foo  \\=  bar'                        | 'foo  \\=  bar'
-      'does not treat escaped hex equal signs as attribute delimiters'      | ' foo  \\3D  bar'                       | 'foo  \\3d  bar'
-      'does not treat escaped commas as attribute delimiters'               | ' Smith\\, John C.'                     | 'smith\\, john c.'
-      'does not treat escaped hex commas as attribute delimiters'           | ' Smith\\2C John C.'                    | 'smith\\2c john c.'
-    end
-
-    with_them do
-      it 'normalizes the UID' do
-        assert_generic_test(test_description, subject, expected)
-      end
-    end
-  end
-
   describe '.normalize_uid' do
     subject { described_class.normalize_uid(given) }
 
-    it_behaves_like 'normalizes the UID'
+    it_behaves_like 'normalizes a DN attribute value'
 
     context 'with an exception during normalization' do
-      let(:given) { described_class } # just something that will cause an exception
+      let(:given) { 'John "Smith,' } # just something that will cause an exception
 
       it 'returns the given UID unmodified' do
         expect(subject).to eq(given)
diff --git a/spec/support/ldap_shared_examples.rb b/spec/support/ldap_shared_examples.rb
new file mode 100644
index 00000000000..3ab8b1d73a1
--- /dev/null
+++ b/spec/support/ldap_shared_examples.rb
@@ -0,0 +1,29 @@
+shared_examples_for 'normalizes a DN attribute value' do
+  using RSpec::Parameterized::TableSyntax
+
+  where(:test_description, :given, :expected) do
+    'strips extraneous whitespace'                                                      | '   John Smith   '                 | 'john smith'
+    'unescapes non-reserved, non-special Unicode characters'                            | 'Sebasti\\c3\\a1n\\ C.\\20Smith'   | 'sebastián c. smith'
+    'downcases the whole string'                                                        | 'JoHn C. Smith'                    | 'john c. smith'
+    'does not strip an escaped leading space in an attribute value'                     | '\\ John Smith'                    | '\\ john smith'
+    'does not strip an escaped trailing space in an attribute value'                    | 'John Smith\\ '                    | 'john smith\\ '
+    'hex-escapes an escaped leading newline in an attribute value'                      | "\\\nJohn Smith"                   | "\\0ajohn smith"
+    'hex-escapes and does not strip an escaped trailing newline in an attribute value'  | "John Smith\\\n"                   | "john smith\\0a"
+    'hex-escapes an unescaped leading newline (actually an invalid DN value?)'          | "\nJohn Smith"                     | "\\0ajohn smith"
+    'strips an unescaped trailing newline (actually an invalid DN value?)'              | "John Smith\n"                     | "john smith"
+    'does not strip if no extraneous whitespace'                                        | 'John Smith'                       | 'john smith'
+    'does not modify an escaped equal sign in an attribute value'                       | ' foo  \\=  bar'                   | 'foo  \\=  bar'
+    'converts an escaped hex equal sign to an escaped equal sign in an attribute value' | ' foo  \\3D  bar'                  | 'foo  \\=  bar'
+    'does not modify an escaped comma in an attribute value'                            | 'San Francisco\\, CA'              | 'san francisco\\, ca'
+    'converts an escaped hex comma to an escaped comma in an attribute value'           | 'San Francisco\\2C CA'             | 'san francisco\\, ca'
+    'does not modify an escaped hex carriage return character in an attribute value'    | 'San Francisco\\,\\0DCA'           | 'san francisco\\,\\0dca'
+    'does not modify an escaped hex line feed character in an attribute value'          | 'San Francisco\\,\\0ACA'           | 'san francisco\\,\\0aca'
+    'does not modify an escaped hex CRLF in an attribute value'                         | 'San Francisco\\,\\0D\\0ACA'       | 'san francisco\\,\\0d\\0aca'
+  end
+
+  with_them do
+    it 'normalizes the DN attribute value' do
+      assert_generic_test(test_description, subject, expected)
+    end
+  end
+end
-- 
cgit v1.2.1


From 3d460af091e7241e4bca7c8ae2880ef0fd2f12b3 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 3 Oct 2017 15:15:23 -0700
Subject: Update DN class in migration

---
 .../20170921101004_normalize_ldap_extern_uids.rb   | 101 ++++++++++++---------
 1 file changed, 60 insertions(+), 41 deletions(-)

diff --git a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
index aa95fa49e48..234e8a3270b 100644
--- a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
+++ b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
@@ -19,6 +19,12 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
       UnsupportedDnFormatError = Class.new(StandardError)
 
       class DN
+        def self.normalize_value(given_value)
+          dummy_dn = "placeholder=#{given_value}"
+          normalized_dn = new(*dummy_dn).to_normalized_s
+          normalized_dn.sub(/\Aplaceholder=/, '')
+        end
+
         ##
         # Initialize a DN, escaping as required. Pass in attributes in name/value
         # pairs. If there is a left over argument, it will be appended to the dn
@@ -28,22 +34,31 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
         # so storing the dn as an escaped String and parsing parts as required
         # with a state machine seems sensible.
         def initialize(*args)
-          buffer = StringIO.new
-
-          args.each_index do |index|
-            buffer << "=" if index.odd?
-            buffer << "," if index.even? && index != 0
+          @dn = if args.length > 1
+                  initialize_array(args)
+                else
+                  initialize_string(args[0])
+                end
+        end
 
-            arg = args[index].downcase
+        def initialize_array(args)
+          buffer = StringIO.new
 
-            buffer << if index < args.length - 1 || index.odd?
-                        self.class.escape(arg)
-                      else
-                        arg
-                      end
+          args.each_with_index do |arg, index|
+            if index.even? # key
+              buffer << "," if index > 0
+              buffer << arg
+            else # value
+              buffer << "="
+              buffer << self.class.escape(arg)
+            end
           end
 
-          @dn = buffer.string
+          buffer.string
+        end
+
+        def initialize_string(arg)
+          arg.to_s
         end
 
         ##
@@ -58,11 +73,11 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
           value = StringIO.new
           hex_buffer = ""
 
-          @dn.each_char do |char|
+          @dn.each_char.with_index do |char, dn_index|
             case state
             when :key then
               case char
-              when 'a'..'z' then
+              when 'a'..'z', 'A'..'Z' then
                 state = :key_normal
                 key << char
               when '0'..'9' then
@@ -74,7 +89,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
             when :key_normal then
               case char
               when '=' then state = :value
-              when 'a'..'z', '0'..'9', '-', ' ' then key << char
+              when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
               else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
               end
             when :key_oid then
@@ -93,7 +108,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
                 value << char
               when ',' then
                 state = :key
-                yield key.string.strip, value.string.rstrip
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                 key = StringIO.new
                 value = StringIO.new
               else
@@ -105,7 +120,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
               when '\\' then state = :value_normal_escape
               when ',' then
                 state = :key
-                yield key.string.strip, value.string.rstrip
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                 key = StringIO.new
                 value = StringIO.new
               when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
@@ -113,34 +128,20 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
               end
             when :value_normal_escape then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_normal_escape_hex
                 hex_buffer = char
-              when /\s/ then
-                state = :value_normal_escape_whitespace
-                value << char
               else
                 state = :value_normal
                 value << char
               end
             when :value_normal_escape_hex then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_normal
                 value << "#{hex_buffer}#{char}".to_i(16).chr
               else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
               end
-            when :value_normal_escape_whitespace then
-              case char
-              when '\\' then state = :value_normal_escape
-              when ',' then
-                state = :key
-                yield key.string.strip, value.string # Don't strip trailing escaped space!
-                key = StringIO.new
-                value = StringIO.new
-              when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
-              else value << char
-              end
             when :value_quoted then
               case char
               when '\\' then state = :value_quoted_escape
@@ -149,7 +150,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
               end
             when :value_quoted_escape then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_quoted_escape_hex
                 hex_buffer = char
               else
@@ -158,27 +159,27 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
               end
             when :value_quoted_escape_hex then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_quoted
                 value << "#{hex_buffer}#{char}".to_i(16).chr
               else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
               end
             when :value_hexstring then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_hexstring_hex
                 value << char
               when ' ' then state = :value_end
               when ',' then
                 state = :key
-                yield key.string.strip, value.string.rstrip
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                 key = StringIO.new
                 value = StringIO.new
               else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
               end
             when :value_hexstring_hex then
               case char
-              when '0'..'9', 'a'..'f' then
+              when '0'..'9', 'a'..'f', 'A'..'F' then
                 state = :value_hexstring
                 value << char
               else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
@@ -188,7 +189,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
               when ' ' then state = :value_end
               when ',' then
                 state = :key
-                yield key.string.strip, value.string.rstrip
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                 key = StringIO.new
                 value = StringIO.new
               else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
@@ -201,7 +202,25 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
           raise(MalformedDnError, 'DN string ended unexpectedly') unless
             [:value, :value_normal, :value_hexstring, :value_end].include? state
 
-          yield key.string.strip, value.string.rstrip
+          yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
+        end
+
+        def rstrip_except_escaped(str, dn_index)
+          str_ends_with_whitespace = str.match(/\s\z/)
+
+          if str_ends_with_whitespace
+            dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
+
+            if dn_part_ends_with_escaped_whitespace
+              dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
+              num_chars_to_remove = dn_part_rwhitespace.length - 1
+              str = str[0, str.length - num_chars_to_remove]
+            else
+              str.rstrip!
+            end
+          end
+
+          str
         end
 
         ##
@@ -221,7 +240,7 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
         ##
         # Return the DN as an escaped and normalized string.
         def to_normalized_s
-          self.class.new(*to_a).to_s
+          self.class.new(*to_a).to_s.downcase
         end
 
         # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
-- 
cgit v1.2.1


From 1879980f2e206943fd97254ec25b7e7fd835871a Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Tue, 3 Oct 2017 15:27:52 -0700
Subject: Move migration to background

---
 .../20170921101004_normalize_ldap_extern_uids.rb   | 293 +-------------------
 .../normalize_ldap_extern_uids_range.rb            | 304 +++++++++++++++++++++
 2 files changed, 313 insertions(+), 284 deletions(-)
 create mode 100644 lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb

diff --git a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
index 234e8a3270b..2230bb0e53c 100644
--- a/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
+++ b/db/post_migrate/20170921101004_normalize_ldap_extern_uids.rb
@@ -5,297 +5,22 @@ class NormalizeLdapExternUids < ActiveRecord::Migration
   include Gitlab::Database::MigrationHelpers
 
   DOWNTIME = false
+  MIGRATION = 'NormalizeLdapExternUidsRange'.freeze
+  DELAY_INTERVAL = 10.seconds
 
-  class Identity < ActiveRecord::Base
-    self.table_name = 'identities'
-  end
-
-  # Copied this class to make this migration resilient to future code changes.
-  # And if the normalize behavior is changed in the future, it must be
-  # accompanied by another migration.
-  module Gitlab
-    module LDAP
-      MalformedDnError = Class.new(StandardError)
-      UnsupportedDnFormatError = Class.new(StandardError)
-
-      class DN
-        def self.normalize_value(given_value)
-          dummy_dn = "placeholder=#{given_value}"
-          normalized_dn = new(*dummy_dn).to_normalized_s
-          normalized_dn.sub(/\Aplaceholder=/, '')
-        end
-
-        ##
-        # Initialize a DN, escaping as required. Pass in attributes in name/value
-        # pairs. If there is a left over argument, it will be appended to the dn
-        # without escaping (useful for a base string).
-        #
-        # Most uses of this class will be to escape a DN, rather than to parse it,
-        # so storing the dn as an escaped String and parsing parts as required
-        # with a state machine seems sensible.
-        def initialize(*args)
-          @dn = if args.length > 1
-                  initialize_array(args)
-                else
-                  initialize_string(args[0])
-                end
-        end
-
-        def initialize_array(args)
-          buffer = StringIO.new
-
-          args.each_with_index do |arg, index|
-            if index.even? # key
-              buffer << "," if index > 0
-              buffer << arg
-            else # value
-              buffer << "="
-              buffer << self.class.escape(arg)
-            end
-          end
-
-          buffer.string
-        end
-
-        def initialize_string(arg)
-          arg.to_s
-        end
-
-        ##
-        # Parse a DN into key value pairs using ASN from
-        # http://tools.ietf.org/html/rfc2253 section 3.
-        # rubocop:disable Metrics/AbcSize
-        # rubocop:disable Metrics/CyclomaticComplexity
-        # rubocop:disable Metrics/PerceivedComplexity
-        def each_pair
-          state = :key
-          key = StringIO.new
-          value = StringIO.new
-          hex_buffer = ""
-
-          @dn.each_char.with_index do |char, dn_index|
-            case state
-            when :key then
-              case char
-              when 'a'..'z', 'A'..'Z' then
-                state = :key_normal
-                key << char
-              when '0'..'9' then
-                state = :key_oid
-                key << char
-              when ' ' then state = :key
-              else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
-              end
-            when :key_normal then
-              case char
-              when '=' then state = :value
-              when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
-              else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
-              end
-            when :key_oid then
-              case char
-              when '=' then state = :value
-              when '0'..'9', '.', ' ' then key << char
-              else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
-              end
-            when :value then
-              case char
-              when '\\' then state = :value_normal_escape
-              when '"' then state = :value_quoted
-              when ' ' then state = :value
-              when '#' then
-                state = :value_hexstring
-                value << char
-              when ',' then
-                state = :key
-                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-                key = StringIO.new
-                value = StringIO.new
-              else
-                state = :value_normal
-                value << char
-              end
-            when :value_normal then
-              case char
-              when '\\' then state = :value_normal_escape
-              when ',' then
-                state = :key
-                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-                key = StringIO.new
-                value = StringIO.new
-              when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
-              else value << char
-              end
-            when :value_normal_escape then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_normal_escape_hex
-                hex_buffer = char
-              else
-                state = :value_normal
-                value << char
-              end
-            when :value_normal_escape_hex then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_normal
-                value << "#{hex_buffer}#{char}".to_i(16).chr
-              else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
-              end
-            when :value_quoted then
-              case char
-              when '\\' then state = :value_quoted_escape
-              when '"' then state = :value_end
-              else value << char
-              end
-            when :value_quoted_escape then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_quoted_escape_hex
-                hex_buffer = char
-              else
-                state = :value_quoted
-                value << char
-              end
-            when :value_quoted_escape_hex then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_quoted
-                value << "#{hex_buffer}#{char}".to_i(16).chr
-              else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
-              end
-            when :value_hexstring then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_hexstring_hex
-                value << char
-              when ' ' then state = :value_end
-              when ',' then
-                state = :key
-                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-                key = StringIO.new
-                value = StringIO.new
-              else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
-              end
-            when :value_hexstring_hex then
-              case char
-              when '0'..'9', 'a'..'f', 'A'..'F' then
-                state = :value_hexstring
-                value << char
-              else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
-              end
-            when :value_end then
-              case char
-              when ' ' then state = :value_end
-              when ',' then
-                state = :key
-                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-                key = StringIO.new
-                value = StringIO.new
-              else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
-              end
-            else raise "Fell out of state machine"
-            end
-          end
-
-          # Last pair
-          raise(MalformedDnError, 'DN string ended unexpectedly') unless
-            [:value, :value_normal, :value_hexstring, :value_end].include? state
-
-          yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
-        end
-
-        def rstrip_except_escaped(str, dn_index)
-          str_ends_with_whitespace = str.match(/\s\z/)
+  disable_ddl_transaction!
 
-          if str_ends_with_whitespace
-            dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
-
-            if dn_part_ends_with_escaped_whitespace
-              dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
-              num_chars_to_remove = dn_part_rwhitespace.length - 1
-              str = str[0, str.length - num_chars_to_remove]
-            else
-              str.rstrip!
-            end
-          end
-
-          str
-        end
-
-        ##
-        # Returns the DN as an array in the form expected by the constructor.
-        def to_a
-          a = []
-          self.each_pair { |key, value| a << key << value } unless @dn.empty?
-          a
-        end
-
-        ##
-        # Return the DN as an escaped string.
-        def to_s
-          @dn
-        end
-
-        ##
-        # Return the DN as an escaped and normalized string.
-        def to_normalized_s
-          self.class.new(*to_a).to_s.downcase
-        end
-
-        # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
-        # for DN values. All of the following must be escaped in any normal string
-        # using a single backslash ('\') as escape. The space character is left
-        # out here because in a "normalized" string, spaces should only be escaped
-        # if necessary (i.e. leading or trailing space).
-        NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
-
-        # The following must be represented as escaped hex
-        HEX_ESCAPES = {
-          "\n" => '\0a',
-          "\r" => '\0d'
-        }.freeze
-
-        # Compiled character class regexp using the keys from the above hash, and
-        # checking for a space or # at the start, or space at the end, of the
-        # string.
-        ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
-                               NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
-                               "])")
-
-        HEX_ESCAPE_RE = Regexp.new("([" +
-                               HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
-                               "])")
-
-        ##
-        # Escape a string for use in a DN value
-        def self.escape(string)
-          escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
-          escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
-        end
+  class Identity < ActiveRecord::Base
+    include EachBatch
 
-        ##
-        # Proxy all other requests to the string object, because a DN is mainly
-        # used within the library as a string
-        # rubocop:disable GitlabSecurity/PublicSend
-        def method_missing(method, *args, &block)
-          @dn.send(method, *args, &block)
-        end
-      end
-    end
+    self.table_name = 'identities'
   end
 
   def up
     ldap_identities = Identity.where("provider like 'ldap%'")
-    ldap_identities.find_each do |identity|
-      begin
-        identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_normalized_s
-        unless identity.save
-          say "Unable to normalize \"#{identity.extern_uid}\". Skipping."
-        end
-      rescue Gitlab::LDAP::MalformedDnError, Gitlab::LDAP::UnsupportedDnFormatError => e
-        say "Unable to normalize \"#{identity.extern_uid}\" due to \"#{e.message}\". Skipping."
-      end
+
+    if ldap_identities.any?
+      queue_background_migration_jobs_by_range_at_intervals(Identity, MIGRATION, DELAY_INTERVAL)
     end
   end
 
diff --git a/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
new file mode 100644
index 00000000000..7a18feb8a4f
--- /dev/null
+++ b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
@@ -0,0 +1,304 @@
+module Gitlab
+  module BackgroundMigration
+    class NormalizeLdapExternUidsRange
+      class Identity < ActiveRecord::Base
+        self.table_name = 'identities'
+      end
+
+      # Copied this class to make this migration resilient to future code changes.
+      # And if the normalize behavior is changed in the future, it must be
+      # accompanied by another migration.
+      module Gitlab
+        module LDAP
+          MalformedDnError = Class.new(StandardError)
+          UnsupportedDnFormatError = Class.new(StandardError)
+
+          class DN
+            def self.normalize_value(given_value)
+              dummy_dn = "placeholder=#{given_value}"
+              normalized_dn = new(*dummy_dn).to_normalized_s
+              normalized_dn.sub(/\Aplaceholder=/, '')
+            end
+
+            ##
+            # Initialize a DN, escaping as required. Pass in attributes in name/value
+            # pairs. If there is a left over argument, it will be appended to the dn
+            # without escaping (useful for a base string).
+            #
+            # Most uses of this class will be to escape a DN, rather than to parse it,
+            # so storing the dn as an escaped String and parsing parts as required
+            # with a state machine seems sensible.
+            def initialize(*args)
+              if args.length > 1
+                initialize_array(args)
+              else
+                initialize_string(args[0])
+              end
+            end
+
+            def initialize_array(args)
+              buffer = StringIO.new
+
+              args.each_with_index do |arg, index|
+                if index.even? # key
+                  buffer << "," if index > 0
+                  buffer << arg
+                else # value
+                  buffer << "="
+                  buffer << self.class.escape(arg)
+                end
+              end
+
+              @dn = buffer.string
+            end
+
+            def initialize_string(arg)
+              @dn = arg.to_s
+            end
+
+            ##
+            # Parse a DN into key value pairs using ASN from
+            # http://tools.ietf.org/html/rfc2253 section 3.
+            # rubocop:disable Metrics/AbcSize
+            # rubocop:disable Metrics/CyclomaticComplexity
+            # rubocop:disable Metrics/PerceivedComplexity
+            def each_pair
+              state = :key
+              key = StringIO.new
+              value = StringIO.new
+              hex_buffer = ""
+
+              @dn.each_char.with_index do |char, dn_index|
+                case state
+                when :key then
+                  case char
+                  when 'a'..'z', 'A'..'Z' then
+                    state = :key_normal
+                    key << char
+                  when '0'..'9' then
+                    state = :key_oid
+                    key << char
+                  when ' ' then state = :key
+                  else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
+                  end
+                when :key_normal then
+                  case char
+                  when '=' then state = :value
+                  when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
+                  else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
+                  end
+                when :key_oid then
+                  case char
+                  when '=' then state = :value
+                  when '0'..'9', '.', ' ' then key << char
+                  else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
+                  end
+                when :value then
+                  case char
+                  when '\\' then state = :value_normal_escape
+                  when '"' then state = :value_quoted
+                  when ' ' then state = :value
+                  when '#' then
+                    state = :value_hexstring
+                    value << char
+                  when ',' then
+                    state = :key
+                    yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                    key = StringIO.new
+                    value = StringIO.new
+                  else
+                    state = :value_normal
+                    value << char
+                  end
+                when :value_normal then
+                  case char
+                  when '\\' then state = :value_normal_escape
+                  when ',' then
+                    state = :key
+                    yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                    key = StringIO.new
+                    value = StringIO.new
+                  when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
+                  else value << char
+                  end
+                when :value_normal_escape then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_normal_escape_hex
+                    hex_buffer = char
+                  else
+                    state = :value_normal
+                    value << char
+                  end
+                when :value_normal_escape_hex then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_normal
+                    value << "#{hex_buffer}#{char}".to_i(16).chr
+                  else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
+                  end
+                when :value_quoted then
+                  case char
+                  when '\\' then state = :value_quoted_escape
+                  when '"' then state = :value_end
+                  else value << char
+                  end
+                when :value_quoted_escape then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_quoted_escape_hex
+                    hex_buffer = char
+                  else
+                    state = :value_quoted
+                    value << char
+                  end
+                when :value_quoted_escape_hex then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_quoted
+                    value << "#{hex_buffer}#{char}".to_i(16).chr
+                  else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
+                  end
+                when :value_hexstring then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_hexstring_hex
+                    value << char
+                  when ' ' then state = :value_end
+                  when ',' then
+                    state = :key
+                    yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                    key = StringIO.new
+                    value = StringIO.new
+                  else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
+                  end
+                when :value_hexstring_hex then
+                  case char
+                  when '0'..'9', 'a'..'f', 'A'..'F' then
+                    state = :value_hexstring
+                    value << char
+                  else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
+                  end
+                when :value_end then
+                  case char
+                  when ' ' then state = :value_end
+                  when ',' then
+                    state = :key
+                    yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                    key = StringIO.new
+                    value = StringIO.new
+                  else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
+                  end
+                else raise "Fell out of state machine"
+                end
+              end
+
+              # Last pair
+              raise(MalformedDnError, 'DN string ended unexpectedly') unless
+                [:value, :value_normal, :value_hexstring, :value_end].include? state
+
+              yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
+            end
+
+            def rstrip_except_escaped(str, dn_index)
+              str_ends_with_whitespace = str.match(/\s\z/)
+
+              if str_ends_with_whitespace
+                dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
+
+                if dn_part_ends_with_escaped_whitespace
+                  dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
+                  num_chars_to_remove = dn_part_rwhitespace.length - 1
+                  str = str[0, str.length - num_chars_to_remove]
+                else
+                  str.rstrip!
+                end
+              end
+
+              str
+            end
+
+            ##
+            # Returns the DN as an array in the form expected by the constructor.
+            def to_a
+              a = []
+              self.each_pair { |key, value| a << key << value } unless @dn.empty?
+              a
+            end
+
+            ##
+            # Return the DN as an escaped string.
+            def to_s
+              @dn
+            end
+
+            ##
+            # Return the DN as an escaped and normalized string.
+            def to_normalized_s
+              self.class.new(*to_a).to_s.downcase
+            end
+
+            # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
+            # for DN values. All of the following must be escaped in any normal string
+            # using a single backslash ('\') as escape. The space character is left
+            # out here because in a "normalized" string, spaces should only be escaped
+            # if necessary (i.e. leading or trailing space).
+            NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
+
+            # The following must be represented as escaped hex
+            HEX_ESCAPES = {
+              "\n" => '\0a',
+              "\r" => '\0d'
+            }.freeze
+
+            # Compiled character class regexp using the keys from the above hash, and
+            # checking for a space or # at the start, or space at the end, of the
+            # string.
+            ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
+                                   NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
+                                   "])")
+
+            HEX_ESCAPE_RE = Regexp.new("([" +
+                                   HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                                   "])")
+
+            ##
+            # Escape a string for use in a DN value
+            def self.escape(string)
+              escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
+              escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
+            end
+
+            ##
+            # Proxy all other requests to the string object, because a DN is mainly
+            # used within the library as a string
+            # rubocop:disable GitlabSecurity/PublicSend
+            def method_missing(method, *args, &block)
+              @dn.send(method, *args, &block)
+            end
+          end
+        end
+      end
+
+      def perform(start_id, end_id)
+        return unless migrate?
+
+        ldap_identities = Identity.where("provider like 'ldap%'").where(id: start_id..end_id)
+        ldap_identities.each do |identity|
+          begin
+            identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_normalized_s
+            unless identity.save
+              Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\". Skipping."
+            end
+          rescue Gitlab::LDAP::MalformedDnError, Gitlab::LDAP::UnsupportedDnFormatError => e
+            Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\" due to \"#{e.message}\". Skipping."
+          end
+        end
+      end
+
+      def migrate?
+        Identity.table_exists?
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 9ac732dda24276f953314d6b3bd5c60571ce82bf Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 4 Oct 2017 22:43:07 -0700
Subject: Add migration specs

---
 .../normalize_ldap_extern_uids_range_spec.rb       | 36 ++++++++++++++
 spec/migrations/normalize_ldap_extern_uids_spec.rb | 56 ++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 spec/lib/gitlab/background_migration/normalize_ldap_extern_uids_range_spec.rb
 create mode 100644 spec/migrations/normalize_ldap_extern_uids_spec.rb

diff --git a/spec/lib/gitlab/background_migration/normalize_ldap_extern_uids_range_spec.rb b/spec/lib/gitlab/background_migration/normalize_ldap_extern_uids_range_spec.rb
new file mode 100644
index 00000000000..dfbf1bb681a
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/normalize_ldap_extern_uids_range_spec.rb
@@ -0,0 +1,36 @@
+require 'spec_helper'
+
+describe Gitlab::BackgroundMigration::NormalizeLdapExternUidsRange, :migration, schema: 20170921101004 do
+  let!(:identities) { table(:identities) }
+
+  before do
+    # LDAP identities
+    (1..4).each do |i|
+      identities.create!(id: i, provider: 'ldapmain', extern_uid: " uid = foo #{i}, ou = People, dc = example, dc = com ", user_id: i)
+    end
+
+    # Non-LDAP identity
+    identities.create!(id: 5, provider: 'foo', extern_uid: " uid = foo 5, ou = People, dc = example, dc = com ", user_id: 5)
+
+    # Another LDAP identity
+    identities.create!(id: 6, provider: 'ldapmain', extern_uid: " uid = foo 6, ou = People, dc = example, dc = com ", user_id: 6)
+  end
+
+  it 'normalizes the LDAP identities in the range' do
+    described_class.new.perform(1, 3)
+    expect(identities.find(1).extern_uid).to eq("uid=foo 1,ou=people,dc=example,dc=com")
+    expect(identities.find(2).extern_uid).to eq("uid=foo 2,ou=people,dc=example,dc=com")
+    expect(identities.find(3).extern_uid).to eq("uid=foo 3,ou=people,dc=example,dc=com")
+    expect(identities.find(4).extern_uid).to eq(" uid = foo 4, ou = People, dc = example, dc = com ")
+    expect(identities.find(5).extern_uid).to eq(" uid = foo 5, ou = People, dc = example, dc = com ")
+    expect(identities.find(6).extern_uid).to eq(" uid = foo 6, ou = People, dc = example, dc = com ")
+
+    described_class.new.perform(4, 6)
+    expect(identities.find(1).extern_uid).to eq("uid=foo 1,ou=people,dc=example,dc=com")
+    expect(identities.find(2).extern_uid).to eq("uid=foo 2,ou=people,dc=example,dc=com")
+    expect(identities.find(3).extern_uid).to eq("uid=foo 3,ou=people,dc=example,dc=com")
+    expect(identities.find(4).extern_uid).to eq("uid=foo 4,ou=people,dc=example,dc=com")
+    expect(identities.find(5).extern_uid).to eq(" uid = foo 5, ou = People, dc = example, dc = com ")
+    expect(identities.find(6).extern_uid).to eq("uid=foo 6,ou=people,dc=example,dc=com")
+  end
+end
diff --git a/spec/migrations/normalize_ldap_extern_uids_spec.rb b/spec/migrations/normalize_ldap_extern_uids_spec.rb
new file mode 100644
index 00000000000..262d7742aaf
--- /dev/null
+++ b/spec/migrations/normalize_ldap_extern_uids_spec.rb
@@ -0,0 +1,56 @@
+require 'spec_helper'
+require Rails.root.join('db', 'post_migrate', '20170921101004_normalize_ldap_extern_uids')
+
+describe NormalizeLdapExternUids, :migration, :sidekiq do
+  let!(:identities) { table(:identities) }
+
+  around do |example|
+    Timecop.freeze { example.run }
+  end
+
+  before do
+    stub_const("Gitlab::Database::MigrationHelpers::BACKGROUND_MIGRATION_BATCH_SIZE", 2)
+    stub_const("Gitlab::Database::MigrationHelpers::BACKGROUND_MIGRATION_JOB_BUFFER_SIZE", 2)
+
+    # LDAP identities
+    (1..4).each do |i|
+      identities.create!(id: i, provider: 'ldapmain', extern_uid: " uid = foo #{i}, ou = People, dc = example, dc = com ", user_id: i)
+    end
+
+    # Non-LDAP identity
+    identities.create!(id: 5, provider: 'foo', extern_uid: " uid = foo 5, ou = People, dc = example, dc = com ", user_id: 5)
+  end
+
+  it 'correctly schedules background migrations' do
+    Sidekiq::Testing.fake! do
+      Timecop.freeze do
+        migrate!
+
+        expect(BackgroundMigrationWorker.jobs[0]['args']).to eq([described_class::MIGRATION, [1, 2]])
+        expect(BackgroundMigrationWorker.jobs[0]['at']).to eq(10.seconds.from_now.to_f)
+        expect(BackgroundMigrationWorker.jobs[1]['args']).to eq([described_class::MIGRATION, [3, 4]])
+        expect(BackgroundMigrationWorker.jobs[1]['at']).to eq(20.seconds.from_now.to_f)
+        expect(BackgroundMigrationWorker.jobs[2]['args']).to eq([described_class::MIGRATION, [5, 5]])
+        expect(BackgroundMigrationWorker.jobs[2]['at']).to eq(30.seconds.from_now.to_f)
+        expect(BackgroundMigrationWorker.jobs.size).to eq 3
+      end
+    end
+  end
+
+  it 'migrates the LDAP identities' do
+    Sidekiq::Testing.inline! do
+      migrate!
+      identities.where(id: 1..4).each do |identity|
+        expect(identity.extern_uid).to eq("uid=foo #{identity.id},ou=people,dc=example,dc=com")
+      end
+    end
+  end
+
+  it 'does not modify non-LDAP identities' do
+    Sidekiq::Testing.inline! do
+      migrate!
+      identity = identities.last
+      expect(identity.extern_uid).to eq(" uid = foo 5, ou = People, dc = example, dc = com ")
+    end
+  end
+end
-- 
cgit v1.2.1


From 1c945de93849b43d2bec9407bd0a7c4afd759796 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Wed, 4 Oct 2017 23:04:53 -0700
Subject: Add changelog entry for LDAP normalization

---
 changelogs/unreleased/mk-normalize-ldap-user-dns.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/mk-normalize-ldap-user-dns.yml

diff --git a/changelogs/unreleased/mk-normalize-ldap-user-dns.yml b/changelogs/unreleased/mk-normalize-ldap-user-dns.yml
new file mode 100644
index 00000000000..5a128d6acc1
--- /dev/null
+++ b/changelogs/unreleased/mk-normalize-ldap-user-dns.yml
@@ -0,0 +1,5 @@
+---
+title: Search or compare LDAP DNs case-insensitively and ignore excess whitespace
+merge_request: 14697
+author:
+type: fixed
-- 
cgit v1.2.1


From 1d1ad7e0b68039100029f20a84fd867fe92cbb32 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Thu, 5 Oct 2017 03:27:07 -0700
Subject: Refactor DN error classes

---
 .../normalize_ldap_extern_uids_range.rb            | 29 +++----
 lib/gitlab/ldap/dn.rb                              | 27 +++---
 lib/gitlab/ldap/person.rb                          |  2 +-
 spec/lib/gitlab/ldap/dn_spec.rb                    | 96 +++++++++++-----------
 4 files changed, 78 insertions(+), 76 deletions(-)

diff --git a/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
index 7a18feb8a4f..cf7eafcff3b 100644
--- a/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
+++ b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
@@ -10,10 +10,11 @@ module Gitlab
       # accompanied by another migration.
       module Gitlab
         module LDAP
-          MalformedDnError = Class.new(StandardError)
-          UnsupportedDnFormatError = Class.new(StandardError)
-
           class DN
+            FormatError = Class.new(StandardError)
+            MalformedError = Class.new(FormatError)
+            UnsupportedError = Class.new(FormatError)
+
             def self.normalize_value(given_value)
               dummy_dn = "placeholder=#{given_value}"
               normalized_dn = new(*dummy_dn).to_normalized_s
@@ -79,19 +80,19 @@ module Gitlab
                     state = :key_oid
                     key << char
                   when ' ' then state = :key
-                  else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
+                  else raise(MalformedError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
                   end
                 when :key_normal then
                   case char
                   when '=' then state = :value
                   when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
-                  else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
+                  else raise(MalformedError, "Unrecognized RDN attribute type name character \"#{char}\"")
                   end
                 when :key_oid then
                   case char
                   when '=' then state = :value
                   when '0'..'9', '.', ' ' then key << char
-                  else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
+                  else raise(MalformedError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
                   end
                 when :value then
                   case char
@@ -118,7 +119,7 @@ module Gitlab
                     yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                     key = StringIO.new
                     value = StringIO.new
-                  when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
+                  when '+' then raise(UnsupportedError, "Multivalued RDNs are not supported")
                   else value << char
                   end
                 when :value_normal_escape then
@@ -135,7 +136,7 @@ module Gitlab
                   when '0'..'9', 'a'..'f', 'A'..'F' then
                     state = :value_normal
                     value << "#{hex_buffer}#{char}".to_i(16).chr
-                  else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
+                  else raise(MalformedError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
                   end
                 when :value_quoted then
                   case char
@@ -157,7 +158,7 @@ module Gitlab
                   when '0'..'9', 'a'..'f', 'A'..'F' then
                     state = :value_quoted
                     value << "#{hex_buffer}#{char}".to_i(16).chr
-                  else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
+                  else raise(MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
                   end
                 when :value_hexstring then
                   case char
@@ -170,14 +171,14 @@ module Gitlab
                     yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                     key = StringIO.new
                     value = StringIO.new
-                  else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
+                  else raise(MalformedError, "Expected the first character of a hex pair, but got \"#{char}\"")
                   end
                 when :value_hexstring_hex then
                   case char
                   when '0'..'9', 'a'..'f', 'A'..'F' then
                     state = :value_hexstring
                     value << char
-                  else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
+                  else raise(MalformedError, "Expected the second character of a hex pair, but got \"#{char}\"")
                   end
                 when :value_end then
                   case char
@@ -187,14 +188,14 @@ module Gitlab
                     yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
                     key = StringIO.new
                     value = StringIO.new
-                  else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
+                  else raise(MalformedError, "Expected the end of an attribute value, but got \"#{char}\"")
                   end
                 else raise "Fell out of state machine"
                 end
               end
 
               # Last pair
-              raise(MalformedDnError, 'DN string ended unexpectedly') unless
+              raise(MalformedError, 'DN string ended unexpectedly') unless
                 [:value, :value_normal, :value_hexstring, :value_end].include? state
 
               yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
@@ -290,7 +291,7 @@ module Gitlab
             unless identity.save
               Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\". Skipping."
             end
-          rescue Gitlab::LDAP::MalformedDnError, Gitlab::LDAP::UnsupportedDnFormatError => e
+          rescue Gitlab::LDAP::DN::FormatError => e
             Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\" due to \"#{e.message}\". Skipping."
           end
         end
diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index 87a7f1c6bc0..c469420f1f9 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -21,10 +21,11 @@
 # class also helps take care of that.
 module Gitlab
   module LDAP
-    MalformedDnError = Class.new(StandardError)
-    UnsupportedDnFormatError = Class.new(StandardError)
-
     class DN
+      FormatError = Class.new(StandardError)
+      MalformedError = Class.new(FormatError)
+      UnsupportedError = Class.new(FormatError)
+
       def self.normalize_value(given_value)
         dummy_dn = "placeholder=#{given_value}"
         normalized_dn = new(*dummy_dn).to_normalized_s
@@ -90,19 +91,19 @@ module Gitlab
               state = :key_oid
               key << char
             when ' ' then state = :key
-            else raise(MalformedDnError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
+            else raise(MalformedError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
             end
           when :key_normal then
             case char
             when '=' then state = :value
             when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
-            else raise(MalformedDnError, "Unrecognized RDN attribute type name character \"#{char}\"")
+            else raise(MalformedError, "Unrecognized RDN attribute type name character \"#{char}\"")
             end
           when :key_oid then
             case char
             when '=' then state = :value
             when '0'..'9', '.', ' ' then key << char
-            else raise(MalformedDnError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
+            else raise(MalformedError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
             end
           when :value then
             case char
@@ -129,7 +130,7 @@ module Gitlab
               yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
-            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
+            when '+' then raise(UnsupportedError, "Multivalued RDNs are not supported")
             else value << char
             end
           when :value_normal_escape then
@@ -146,7 +147,7 @@ module Gitlab
             when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_normal
               value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise(MalformedDnError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
+            else raise(MalformedError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
             end
           when :value_quoted then
             case char
@@ -168,7 +169,7 @@ module Gitlab
             when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_quoted
               value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise(MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
+            else raise(MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
             end
           when :value_hexstring then
             case char
@@ -181,14 +182,14 @@ module Gitlab
               yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
-            else raise(MalformedDnError, "Expected the first character of a hex pair, but got \"#{char}\"")
+            else raise(MalformedError, "Expected the first character of a hex pair, but got \"#{char}\"")
             end
           when :value_hexstring_hex then
             case char
             when '0'..'9', 'a'..'f', 'A'..'F' then
               state = :value_hexstring
               value << char
-            else raise(MalformedDnError, "Expected the second character of a hex pair, but got \"#{char}\"")
+            else raise(MalformedError, "Expected the second character of a hex pair, but got \"#{char}\"")
             end
           when :value_end then
             case char
@@ -198,14 +199,14 @@ module Gitlab
               yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
               key = StringIO.new
               value = StringIO.new
-            else raise(MalformedDnError, "Expected the end of an attribute value, but got \"#{char}\"")
+            else raise(MalformedError, "Expected the end of an attribute value, but got \"#{char}\"")
             end
           else raise "Fell out of state machine"
           end
         end
 
         # Last pair
-        raise(MalformedDnError, 'DN string ended unexpectedly') unless
+        raise(MalformedError, 'DN string ended unexpectedly') unless
           [:value, :value_normal, :value_hexstring, :value_end].include? state
 
         yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index e91e3a176e6..81aa352e656 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -42,7 +42,7 @@ module Gitlab
       # 2. The string is downcased (for case-insensitivity)
       def self.normalize_uid(uid)
         ::Gitlab::LDAP::DN.normalize_value(uid)
-      rescue ::Gitlab::LDAP::MalformedDnError, ::Gitlab::LDAP::UnsupportedDnFormatError => e
+      rescue ::Gitlab::LDAP::DN::FormatError => e
         Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
         Rails.logger.info(e.backtrace.join("\n"))
 
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index 709eadd7e38..c300f7160fe 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -12,64 +12,64 @@ describe Gitlab::LDAP::DN do
       context 'when ending with a comma' do
         let(:given) { 'John Smith,' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'when given a BER encoded attribute value with a space in it' do
         let(:given) { '#aa aa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
         end
       end
 
       context 'when given a BER encoded attribute value with a non-hex character in it' do
         let(:given) { '#aaXaaa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"X\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
         end
       end
 
       context 'when given a BER encoded attribute value with a non-hex character in it' do
         let(:given) { '#aaaYaa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"Y\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
         end
       end
 
       context 'when given a hex pair with a non-hex character in it, inside double quotes' do
         let(:given) { '"Sebasti\\cX\\a1n"' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
         end
       end
 
       context 'with an open (as opposed to closed) double quote' do
         let(:given) { '"James' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'with an invalid escaped hex code' do
         let(:given) { 'J\ames' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
         end
       end
 
       context 'with a value ending with the escape character' do
         let(:given) { 'foo\\' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
     end
@@ -119,8 +119,8 @@ describe Gitlab::LDAP::DN do
         context 'without extraneous whitespace' do
           let(:given) { 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com' }
 
-          it 'raises UnsupportedDnFormatError' do
-            expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+          it 'raises UnsupportedError' do
+            expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
           end
         end
 
@@ -128,16 +128,16 @@ describe Gitlab::LDAP::DN do
           context 'around the phone number plus sign' do
             let(:given) { 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com' }
 
-            it 'raises UnsupportedDnFormatError' do
-              expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            it 'raises UnsupportedError' do
+              expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
             end
           end
 
           context 'not around the phone number plus sign' do
             let(:given) { 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com' }
 
-            it 'raises UnsupportedDnFormatError' do
-              expect { subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            it 'raises UnsupportedError' do
+              expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
             end
           end
         end
@@ -148,104 +148,104 @@ describe Gitlab::LDAP::DN do
       context 'when ending with a comma' do
         let(:given) { 'uid=John Smith,' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'when given a BER encoded attribute value with a space in it' do
         let(:given) { '0.9.2342.19200300.100.1.25=#aa aa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the end of an attribute value, but got \"a\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
         end
       end
 
       context 'when given a BER encoded attribute value with a non-hex character in it' do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaXaaa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the first character of a hex pair, but got \"X\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
         end
       end
 
       context 'when given a BER encoded attribute value with a non-hex character in it' do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaaYaa' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair, but got \"Y\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
         end
       end
 
       context 'when given a hex pair with a non-hex character in it, inside double quotes' do
         let(:given) { 'uid="Sebasti\\cX\\a1n"' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
         end
       end
 
       context 'without a name value pair' do
         let(:given) { 'John' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'with an open (as opposed to closed) double quote' do
         let(:given) { 'cn="James' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'with an invalid escaped hex code' do
         let(:given) { 'cn=J\ames' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Invalid escaped hex code "\am"')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
         end
       end
 
       context 'with a value ending with the escape character' do
         let(:given) { 'cn=\\' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'DN string ended unexpectedly')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
       context 'with an invalid OID attribute type name' do
         let(:given) { '1.2.d=Value' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN OID attribute type name character "d"')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN OID attribute type name character "d"')
         end
       end
 
       context 'with a period in a non-OID attribute type name' do
         let(:given) { 'd1.2=Value' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "."')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "."')
         end
       end
 
       context 'when starting with non-space, non-alphanumeric character' do
         let(:given) { ' -uid=John Smith' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized first character of an RDN attribute type name "-"')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized first character of an RDN attribute type name "-"')
         end
       end
 
       context 'when given a UID with an escaped equal sign' do
         let(:given) { 'uid\\=john' }
 
-        it 'raises MalformedDnError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::MalformedDnError, 'Unrecognized RDN attribute type name character "\\"')
+        it 'raises MalformedError' do
+          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "\\"')
         end
       end
     end
-- 
cgit v1.2.1


From 8c29a04549d4a956508ef9a92a043a309978fa34 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Thu, 5 Oct 2017 03:47:48 -0700
Subject: Leave bad DNs alone instead of raising errors

---
 lib/gitlab/ldap/auth_hash.rb         |  2 +-
 lib/gitlab/ldap/person.rb            | 11 ++++++++--
 spec/lib/gitlab/ldap/dn_spec.rb      | 36 +-------------------------------
 spec/lib/gitlab/ldap/person_spec.rb  | 14 +++++++++++++
 spec/support/ldap_shared_examples.rb | 40 ++++++++++++++++++++++++++++++++++++
 5 files changed, 65 insertions(+), 38 deletions(-)

diff --git a/lib/gitlab/ldap/auth_hash.rb b/lib/gitlab/ldap/auth_hash.rb
index b173b879f5f..3123da17fd9 100644
--- a/lib/gitlab/ldap/auth_hash.rb
+++ b/lib/gitlab/ldap/auth_hash.rb
@@ -4,7 +4,7 @@ module Gitlab
   module LDAP
     class AuthHash < Gitlab::OAuth::AuthHash
       def uid
-        Gitlab::LDAP::DN.new(super).to_normalized_s
+        Gitlab::LDAP::Person.normalize_dn(super)
       end
 
       private
diff --git a/lib/gitlab/ldap/person.rb b/lib/gitlab/ldap/person.rb
index 81aa352e656..38d7a9ba2f5 100644
--- a/lib/gitlab/ldap/person.rb
+++ b/lib/gitlab/ldap/person.rb
@@ -36,6 +36,14 @@ module Gitlab
         ]
       end
 
+      def self.normalize_dn(dn)
+        ::Gitlab::LDAP::DN.new(dn).to_normalized_s
+      rescue ::Gitlab::LDAP::DN::FormatError => e
+        Rails.logger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
+
+        dn
+      end
+
       # Returns the UID in a normalized form.
       #
       # 1. Excess spaces are stripped
@@ -44,7 +52,6 @@ module Gitlab
         ::Gitlab::LDAP::DN.normalize_value(uid)
       rescue ::Gitlab::LDAP::DN::FormatError => e
         Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
-        Rails.logger.info(e.backtrace.join("\n"))
 
         uid
       end
@@ -72,7 +79,7 @@ module Gitlab
       end
 
       def dn
-        DN.new(entry.dn).to_normalized_s
+        self.class.normalize_dn(entry.dn)
       end
 
       private
diff --git a/spec/lib/gitlab/ldap/dn_spec.rb b/spec/lib/gitlab/ldap/dn_spec.rb
index c300f7160fe..8e21ecdf9ab 100644
--- a/spec/lib/gitlab/ldap/dn_spec.rb
+++ b/spec/lib/gitlab/ldap/dn_spec.rb
@@ -78,41 +78,7 @@ describe Gitlab::LDAP::DN do
   describe '#to_normalized_s' do
     subject { described_class.new(given).to_normalized_s }
 
-    where(:test_description, :given, :expected) do
-      'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
-      'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
-      'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'      | 'uid=sebastián c. smith,ou=people (aka. \\"humans\\"),dc=example,dc=com'
-      'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
-      'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
-      'does not strip an escaped leading space in the last attribute value'                          | 'uid=\\ John Smith'                                                                                   | 'uid=\\ john smith'
-      'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-      'strips extraneous spaces after an escaped trailing space'                                     | 'uid=John Smith\\   ,ou=People,dc=example,dc=com'                                                     | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
-      'strips extraneous spaces after an escaped trailing space at the end of the DN'                | 'uid=John Smith,ou=People,dc=example,dc=com\\   '                                                     | 'uid=john smith,ou=people,dc=example,dc=com\\ '
-      'properly preserves escaped trailing space after unescaped trailing spaces'                    | 'uid=John Smith  \\  ,ou=People,dc=example,dc=com'                                                    | 'uid=john smith  \\ ,ou=people,dc=example,dc=com'
-      'preserves multiple inner spaces in an attribute value'                                        | 'uid=John   Smith,ou=People,dc=example,dc=com'                                                        | 'uid=john   smith,ou=people,dc=example,dc=com'
-      'preserves inner spaces after an escaped space'                                                | 'uid=John\\   Smith,ou=People,dc=example,dc=com'                                                      | 'uid=john   smith,ou=people,dc=example,dc=com'
-      'hex-escapes an escaped leading newline in an attribute value'                                 | "uid=\\\nJohn Smith,ou=People,dc=example,dc=com"                                                      | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
-      'hex-escapes and does not strip an escaped trailing newline in an attribute value'             | "uid=John Smith\\\n,ou=People,dc=example,dc=com"                                                      | "uid=john smith\\0a,ou=people,dc=example,dc=com"
-      'hex-escapes an unescaped leading newline (actually an invalid DN?)'                           | "uid=\nJohn Smith,ou=People,dc=example,dc=com"                                                        | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
-      'strips an unescaped trailing newline (actually an invalid DN?)'                               | "uid=John Smith\n,ou=People,dc=example,dc=com"                                                        | "uid=john smith,ou=people,dc=example,dc=com"
-      'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
-      'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
-      'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
-      'does not modify an escaped comma in an attribute value'                                       | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
-      'converts an escaped hex comma to an escaped comma in an attribute value'                      | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\, ca'
-      'does not modify an escaped hex carriage return character in an attribute value'               | 'uid= John C. Smith, ou=San Francisco\\,\\0DCA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0dca'
-      'does not modify an escaped hex line feed character in an attribute value'                     | 'uid= John C. Smith, ou=San Francisco\\,\\0ACA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0aca'
-      'does not modify an escaped hex CRLF in an attribute value'                                    | 'uid= John C. Smith, ou=San Francisco\\,\\0D\\0ACA'                                                   | 'uid=john c. smith,ou=san francisco\\,\\0d\\0aca'
-      'allows attribute type name OIDs'                                                              | '0.9.2342.19200300.100.1.25=Example,0.9.2342.19200300.100.1.25=Com'                                   | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
-      'strips extraneous whitespace from attribute type name OIDs'                                   | '0.9.2342.19200300.100.1.25 = Example, 0.9.2342.19200300.100.1.25 = Com'                              | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
-    end
-
-    with_them do
-      it 'normalizes the DN' do
-        assert_generic_test(test_description, subject, expected)
-      end
-    end
+    it_behaves_like 'normalizes a DN'
 
     context 'when we do not support the given DN format' do
       context 'multivalued RDNs' do
diff --git a/spec/lib/gitlab/ldap/person_spec.rb b/spec/lib/gitlab/ldap/person_spec.rb
index 743b3fbde2b..d204050ef66 100644
--- a/spec/lib/gitlab/ldap/person_spec.rb
+++ b/spec/lib/gitlab/ldap/person_spec.rb
@@ -16,6 +16,20 @@ describe Gitlab::LDAP::Person do
     )
   end
 
+  describe '.normalize_dn' do
+    subject { described_class.normalize_dn(given) }
+
+    it_behaves_like 'normalizes a DN'
+
+    context 'with an exception during normalization' do
+      let(:given) { 'John "Smith,' } # just something that will cause an exception
+
+      it 'returns the given DN unmodified' do
+        expect(subject).to eq(given)
+      end
+    end
+  end
+
   describe '.normalize_uid' do
     subject { described_class.normalize_uid(given) }
 
diff --git a/spec/support/ldap_shared_examples.rb b/spec/support/ldap_shared_examples.rb
index 3ab8b1d73a1..52c34e78965 100644
--- a/spec/support/ldap_shared_examples.rb
+++ b/spec/support/ldap_shared_examples.rb
@@ -1,3 +1,43 @@
+shared_examples_for 'normalizes a DN' do
+  using RSpec::Parameterized::TableSyntax
+
+  where(:test_description, :given, :expected) do
+    'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
+    'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
+    'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com'      | 'uid=sebastián c. smith,ou=people (aka. \\"humans\\"),dc=example,dc=com'
+    'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+    'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
+    'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
+    'does not strip an escaped leading space in the last attribute value'                          | 'uid=\\ John Smith'                                                                                   | 'uid=\\ john smith'
+    'does not strip an escaped trailing space in an attribute value'                               | 'uid=John Smith\\ ,ou=People,dc=example,dc=com'                                                       | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+    'strips extraneous spaces after an escaped trailing space'                                     | 'uid=John Smith\\   ,ou=People,dc=example,dc=com'                                                     | 'uid=john smith\\ ,ou=people,dc=example,dc=com'
+    'strips extraneous spaces after an escaped trailing space at the end of the DN'                | 'uid=John Smith,ou=People,dc=example,dc=com\\   '                                                     | 'uid=john smith,ou=people,dc=example,dc=com\\ '
+    'properly preserves escaped trailing space after unescaped trailing spaces'                    | 'uid=John Smith  \\  ,ou=People,dc=example,dc=com'                                                    | 'uid=john smith  \\ ,ou=people,dc=example,dc=com'
+    'preserves multiple inner spaces in an attribute value'                                        | 'uid=John   Smith,ou=People,dc=example,dc=com'                                                        | 'uid=john   smith,ou=people,dc=example,dc=com'
+    'preserves inner spaces after an escaped space'                                                | 'uid=John\\   Smith,ou=People,dc=example,dc=com'                                                      | 'uid=john   smith,ou=people,dc=example,dc=com'
+    'hex-escapes an escaped leading newline in an attribute value'                                 | "uid=\\\nJohn Smith,ou=People,dc=example,dc=com"                                                      | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
+    'hex-escapes and does not strip an escaped trailing newline in an attribute value'             | "uid=John Smith\\\n,ou=People,dc=example,dc=com"                                                      | "uid=john smith\\0a,ou=people,dc=example,dc=com"
+    'hex-escapes an unescaped leading newline (actually an invalid DN?)'                           | "uid=\nJohn Smith,ou=People,dc=example,dc=com"                                                        | "uid=\\0ajohn smith,ou=people,dc=example,dc=com"
+    'strips an unescaped trailing newline (actually an invalid DN?)'                               | "uid=John Smith\n,ou=People,dc=example,dc=com"                                                        | "uid=john smith,ou=people,dc=example,dc=com"
+    'does not strip if no extraneous whitespace'                                                   | 'uid=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
+    'does not modify an escaped equal sign in an attribute value'                                  | 'uid= foo  \\=  bar'                                                                                  | 'uid=foo  \\=  bar'
+    'converts an escaped hex equal sign to an escaped equal sign in an attribute value'            | 'uid= foo  \\3D  bar'                                                                                 | 'uid=foo  \\=  bar'
+    'does not modify an escaped comma in an attribute value'                                       | 'uid= John C. Smith, ou=San Francisco\\, CA'                                                          | 'uid=john c. smith,ou=san francisco\\, ca'
+    'converts an escaped hex comma to an escaped comma in an attribute value'                      | 'uid= John C. Smith, ou=San Francisco\\2C CA'                                                         | 'uid=john c. smith,ou=san francisco\\, ca'
+    'does not modify an escaped hex carriage return character in an attribute value'               | 'uid= John C. Smith, ou=San Francisco\\,\\0DCA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0dca'
+    'does not modify an escaped hex line feed character in an attribute value'                     | 'uid= John C. Smith, ou=San Francisco\\,\\0ACA'                                                       | 'uid=john c. smith,ou=san francisco\\,\\0aca'
+    'does not modify an escaped hex CRLF in an attribute value'                                    | 'uid= John C. Smith, ou=San Francisco\\,\\0D\\0ACA'                                                   | 'uid=john c. smith,ou=san francisco\\,\\0d\\0aca'
+    'allows attribute type name OIDs'                                                              | '0.9.2342.19200300.100.1.25=Example,0.9.2342.19200300.100.1.25=Com'                                   | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
+    'strips extraneous whitespace from attribute type name OIDs'                                   | '0.9.2342.19200300.100.1.25 = Example, 0.9.2342.19200300.100.1.25 = Com'                              | '0.9.2342.19200300.100.1.25=example,0.9.2342.19200300.100.1.25=com'
+  end
+
+  with_them do
+    it 'normalizes the DN' do
+      assert_generic_test(test_description, subject, expected)
+    end
+  end
+end
+
 shared_examples_for 'normalizes a DN attribute value' do
   using RSpec::Parameterized::TableSyntax
 
-- 
cgit v1.2.1


From e0a0c6b04ebcd92640cd9a840c5a45ec39d0d59a Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Fri, 6 Oct 2017 10:48:22 -0700
Subject: Make internal methods private

---
 lib/gitlab/ldap/dn.rb | 42 ++++++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index c469420f1f9..ad66f5e96e4 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -48,26 +48,6 @@ module Gitlab
         end
       end
 
-      def initialize_array(args)
-        buffer = StringIO.new
-
-        args.each_with_index do |arg, index|
-          if index.even? # key
-            buffer << "," if index > 0
-            buffer << arg
-          else # value
-            buffer << "="
-            buffer << self.class.escape(arg)
-          end
-        end
-
-        @dn = buffer.string
-      end
-
-      def initialize_string(arg)
-        @dn = arg.to_s
-      end
-
       ##
       # Parse a DN into key value pairs using ASN from
       # http://tools.ietf.org/html/rfc2253 section 3.
@@ -281,6 +261,28 @@ module Gitlab
         escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
       end
 
+      private
+
+      def initialize_array(args)
+        buffer = StringIO.new
+
+        args.each_with_index do |arg, index|
+          if index.even? # key
+            buffer << "," if index > 0
+            buffer << arg
+          else # value
+            buffer << "="
+            buffer << self.class.escape(arg)
+          end
+        end
+
+        @dn = buffer.string
+      end
+
+      def initialize_string(arg)
+        @dn = arg.to_s
+      end
+
       ##
       # Proxy all other requests to the string object, because a DN is mainly
       # used within the library as a string
-- 
cgit v1.2.1


From 2df7d03586dbe9daa883ccd660d77d7522df29f8 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Fri, 6 Oct 2017 10:53:35 -0700
Subject: Redefine `respond_to?` in light of `method_missing`

---
 lib/gitlab/ldap/dn.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/gitlab/ldap/dn.rb b/lib/gitlab/ldap/dn.rb
index ad66f5e96e4..d6142dc6549 100644
--- a/lib/gitlab/ldap/dn.rb
+++ b/lib/gitlab/ldap/dn.rb
@@ -290,6 +290,12 @@ module Gitlab
       def method_missing(method, *args, &block)
         @dn.send(method, *args, &block)
       end
+
+      ##
+      # Redefined to be consistent with redefined `method_missing` behavior
+      def respond_to?(sym, include_private = false)
+        @dn.respond_to?(sym, include_private)
+      end
     end
   end
 end
-- 
cgit v1.2.1


From ac5784368fb23260abd4050a48c4443017c87bfc Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Fri, 6 Oct 2017 10:57:00 -0700
Subject: Sync up hard coded DN class in migration

---
 .../normalize_ldap_extern_uids_range.rb            | 48 +++++++++++++---------
 1 file changed, 28 insertions(+), 20 deletions(-)

diff --git a/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
index cf7eafcff3b..bc53e6d7f94 100644
--- a/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
+++ b/lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
@@ -37,26 +37,6 @@ module Gitlab
               end
             end
 
-            def initialize_array(args)
-              buffer = StringIO.new
-
-              args.each_with_index do |arg, index|
-                if index.even? # key
-                  buffer << "," if index > 0
-                  buffer << arg
-                else # value
-                  buffer << "="
-                  buffer << self.class.escape(arg)
-                end
-              end
-
-              @dn = buffer.string
-            end
-
-            def initialize_string(arg)
-              @dn = arg.to_s
-            end
-
             ##
             # Parse a DN into key value pairs using ASN from
             # http://tools.ietf.org/html/rfc2253 section 3.
@@ -270,6 +250,28 @@ module Gitlab
               escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
             end
 
+            private
+
+            def initialize_array(args)
+              buffer = StringIO.new
+
+              args.each_with_index do |arg, index|
+                if index.even? # key
+                  buffer << "," if index > 0
+                  buffer << arg
+                else # value
+                  buffer << "="
+                  buffer << self.class.escape(arg)
+                end
+              end
+
+              @dn = buffer.string
+            end
+
+            def initialize_string(arg)
+              @dn = arg.to_s
+            end
+
             ##
             # Proxy all other requests to the string object, because a DN is mainly
             # used within the library as a string
@@ -277,6 +279,12 @@ module Gitlab
             def method_missing(method, *args, &block)
               @dn.send(method, *args, &block)
             end
+
+            ##
+            # Redefined to be consistent with redefined `method_missing` behavior
+            def respond_to?(sym, include_private = false)
+              @dn.respond_to?(sym, include_private)
+            end
           end
         end
       end
-- 
cgit v1.2.1


From 1182fccd3ee894bf971c13a3f3ecf6eff774c1ea Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 7 Oct 2017 12:10:46 -0700
Subject: Remove executable permissions on images to make docs lint happy

[ci skip]
---
 .../ux_guide/img/illustration-size-large-horizontal.png     | Bin
 doc/development/ux_guide/img/illustration-size-medium.png   | Bin
 .../ux_guide/img/illustrations-border-radius.png            | Bin
 doc/development/ux_guide/img/illustrations-caps-do.png      | Bin
 doc/development/ux_guide/img/illustrations-caps-don't.png   | Bin
 doc/development/ux_guide/img/illustrations-color-grey.png   | Bin
 doc/development/ux_guide/img/illustrations-color-orange.png | Bin
 doc/development/ux_guide/img/illustrations-color-purple.png | Bin
 doc/development/ux_guide/img/illustrations-geometric.png    | Bin
 .../ux_guide/img/illustrations-palette-oragne.png           | Bin
 .../ux_guide/img/illustrations-palette-purple.png           | Bin
 11 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 doc/development/ux_guide/img/illustration-size-large-horizontal.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustration-size-medium.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-border-radius.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-caps-do.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-caps-don't.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-color-grey.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-color-orange.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-color-purple.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-geometric.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-palette-oragne.png
 mode change 100755 => 100644 doc/development/ux_guide/img/illustrations-palette-purple.png

diff --git a/doc/development/ux_guide/img/illustration-size-large-horizontal.png b/doc/development/ux_guide/img/illustration-size-large-horizontal.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustration-size-medium.png b/doc/development/ux_guide/img/illustration-size-medium.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-border-radius.png b/doc/development/ux_guide/img/illustrations-border-radius.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-caps-do.png b/doc/development/ux_guide/img/illustrations-caps-do.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-caps-don't.png b/doc/development/ux_guide/img/illustrations-caps-don't.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-color-grey.png b/doc/development/ux_guide/img/illustrations-color-grey.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-color-orange.png b/doc/development/ux_guide/img/illustrations-color-orange.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-color-purple.png b/doc/development/ux_guide/img/illustrations-color-purple.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-geometric.png b/doc/development/ux_guide/img/illustrations-geometric.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-palette-oragne.png b/doc/development/ux_guide/img/illustrations-palette-oragne.png
old mode 100755
new mode 100644
diff --git a/doc/development/ux_guide/img/illustrations-palette-purple.png b/doc/development/ux_guide/img/illustrations-palette-purple.png
old mode 100755
new mode 100644
-- 
cgit v1.2.1


From 392e5df796166f0ebe04cca8f6301bcdc676543e Mon Sep 17 00:00:00 2001
From: Bob Van Landuyt <bob@vanlanduyt.co>
Date: Sun, 8 Oct 2017 18:16:04 +0200
Subject: Don't create fork networks for root projects that are deleted

---
 .../background_migration/create_fork_network_memberships_range.rb | 5 +++++
 lib/gitlab/background_migration/populate_fork_networks_range.rb   | 5 +++++
 .../background_migration/populate_fork_networks_range_spec.rb     | 8 ++++++++
 3 files changed, 18 insertions(+)

diff --git a/lib/gitlab/background_migration/create_fork_network_memberships_range.rb b/lib/gitlab/background_migration/create_fork_network_memberships_range.rb
index 4b468e9cd58..c88eb9783ed 100644
--- a/lib/gitlab/background_migration/create_fork_network_memberships_range.rb
+++ b/lib/gitlab/background_migration/create_fork_network_memberships_range.rb
@@ -46,6 +46,11 @@ module Gitlab
             FROM fork_network_members
             WHERE fork_network_members.project_id = forked_project_links.forked_to_project_id
           )
+          AND EXISTS (
+            SELECT true
+            FROM projects
+            WHERE forked_project_links.forked_from_project_id = projects.id
+          )
           AND forked_project_links.id BETWEEN #{start_id} AND #{end_id}
         MISSING_MEMBERS
 
diff --git a/lib/gitlab/background_migration/populate_fork_networks_range.rb b/lib/gitlab/background_migration/populate_fork_networks_range.rb
index 6c355ed1e75..2ef3a207dd3 100644
--- a/lib/gitlab/background_migration/populate_fork_networks_range.rb
+++ b/lib/gitlab/background_migration/populate_fork_networks_range.rb
@@ -20,6 +20,11 @@ module Gitlab
             FROM fork_networks
             WHERE forked_project_links.forked_from_project_id = fork_networks.root_project_id
           )
+          AND EXISTS (
+            SELECT true
+            FROM projects
+            WHERE projects.id = forked_project_links.forked_from_project_id
+          )
           AND forked_project_links.id BETWEEN #{start_id} AND #{end_id}
         INSERT_NETWORKS
 
diff --git a/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb b/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb
index 3ef1873e615..2c2684a6fc9 100644
--- a/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb
+++ b/spec/lib/gitlab/background_migration/populate_fork_networks_range_spec.rb
@@ -62,6 +62,14 @@ describe Gitlab::BackgroundMigration::PopulateForkNetworksRange, :migration, sch
     expect(base2_membership).not_to be_nil
   end
 
+  it 'skips links that had their source project deleted' do
+    forked_project_links.create(id: 6, forked_from_project_id: 99999, forked_to_project_id: create(:project).id)
+
+    migration.perform(5, 8)
+
+    expect(fork_networks.find_by(root_project_id: 99999)).to be_nil
+  end
+
   it 'schedules a job for inserting memberships for forks-of-forks' do
     delay = Gitlab::BackgroundMigration::CreateForkNetworkMembershipsRange::RESCHEDULE_DELAY
 
-- 
cgit v1.2.1


From b775fe7a8e3571dab4a4f0c332bdd447535ea406 Mon Sep 17 00:00:00 2001
From: Tim Zallmann <tzallmann@gitlab.com>
Date: Fri, 6 Oct 2017 14:44:22 +0200
Subject: Updated Icons + Fix for Collapsed Groups Angle

---
 app/assets/images/icons.json                                    | 2 +-
 app/assets/images/icons.svg                                     | 2 +-
 app/views/layouts/nav/breadcrumbs/_collapsed_dropdown.html.haml | 2 +-
 yarn.lock                                                       | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/assets/images/icons.json b/app/assets/images/icons.json
index 6b8f85e37fd..c0ed2ffdcb2 100644
--- a/app/assets/images/icons.json
+++ b/app/assets/images/icons.json
@@ -1 +1 @@
-{"iconCount":135,"spriteSize":58718,"icons":["abuse","account","admin","angle-double-left","angle-double-right","angle-down","angle-left","angle-right","angle-up","appearance","applications","approval","arrow-right","assignee","bold","book","branch","calendar","cancel","chevron-down","chevron-left","chevron-right","chevron-up","clock","close","code","comment-dots","comment-next","comment","comments","commit","credit-card","disk","doc_code","doc_image","doc_text","download","duplicate","earth","eye-slash","eye","file-additions","file-deletion","file-modified","filter","folder","fork","geo-nodes","git-merge","group","history","home","hook","issue-block","issue-child","issue-close","issue-duplicate","issue-new","issue-open-m","issue-open","issue-parent","issues","key-2","key","label","labels","leave","level-up","license","link","list-bulleted","list-numbered","location-dot","location","lock-open","lock","log","mail","merge-request-close","messages","mobile-issue-close","monitor","more","notifications-off","notifications","overview","pencil","pipeline","play","plus-square-o","plus-square","plus","preferences","profile","project","push-rules","question-o","question","quote","redo","remove","repeat","retry","scale","screen-full","screen-normal","search","settings","shield","slight-frown","slight-smile","smile","smiley","snippet","spam","star-o","star","stop","talic","task-done","template","thump-down","thump-up","timer","todo-add","todo-done","token","unapproval","unassignee","unlink","user","users","volume-up","warning","work"]}
\ No newline at end of file
+{"iconCount":164,"spriteSize":72823,"icons":["abuse","account","admin","angle-double-left","angle-double-right","angle-down","angle-left","angle-right","angle-up","appearance","applications","approval","arrow-right","assignee","bold","book","branch","calendar","cancel","chevron-down","chevron-left","chevron-right","chevron-up","clock","close","code","collapse","comment-dots","comment-next","comment","comments","commit","credit-card","dashboard","disk","doc_code","doc_image","doc_text","download","duplicate","earth","eye-slash","eye","file-additions","file-deletion","file-modified","filter","folder","fork","geo-nodes","git-merge","group","history","home","hook","image-comment-dark","import","issue-block","issue-child","issue-close","issue-duplicate","issue-new","issue-open-m","issue-open","issue-parent","issues","key-2","key","label","labels","leave","level-up","license","link","list-bulleted","list-numbered","location-dot","location","lock-open","lock","log","mail","menu","merge-request-close","messages","mobile-issue-close","monitor","more","notifications-off","notifications","overview","pencil","pipeline","play","plus-square-o","plus-square","plus","preferences","profile","project","push-rules","question-o","question","quote","redo","remove","repeat","retry","scale","screen-full","screen-normal","scroll_down","scroll_up","search","settings","shield","slight-frown","slight-smile","smile","smiley","snippet","spam","star-o","star","status_canceled_borderless","status_canceled","status_closed","status_created_borderless","status_created","status_failed_borderless","status_failed","status_manual_borderless","status_manual","status_notfound_borderless","status_open","status_pending_borderless","status_pending","status_running_borderless","status_running","status_skipped_borderless","status_skipped","status_success_borderless","status_success_solid","status_success","status_warning_borderless","status_warning","stop","talic","task-done","template","thump-down","thump-up","timer","todo-add","todo-done","token","unapproval","unassignee","unlink","user","users","volume-up","warning","work"]}
\ No newline at end of file
diff --git a/app/assets/images/icons.svg b/app/assets/images/icons.svg
index 30cb2109ec2..b9829d0d450 100644
--- a/app/assets/images/icons.svg
+++ b/app/assets/images/icons.svg
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><symbol viewBox="0 0 16 16" id="abuse" xmlns="http://www.w3.org/2000/svg"><path d="M11.408.328l4.029 3.222A1.5 1.5 0 0 1 16 4.72v6.555a1.5 1.5 0 0 1-.563 1.171l-4.026 3.224a1.5 1.5 0 0 1-.937.329H5.529a1.5 1.5 0 0 1-.937-.328L.563 12.45A1.5 1.5 0 0 1 0 11.28V4.724a1.5 1.5 0 0 1 .563-1.171L4.589.329A1.5 1.5 0 0 1 5.526 0h4.945c.34 0 .67.116.937.328zM10.296 2H5.702L2 4.964v6.074L5.704 14h4.594L14 11.036V4.962L10.296 2zM8 4a1 1 0 0 1 1 1v3a1 1 0 1 1-2 0V5a1 1 0 0 1 1-1zm0 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="account" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9.195 9.965l-.568-.875a.25.25 0 0 1 .015-.294l.405-.5a.25.25 0 0 1 .283-.075l.938.36c.257-.183.543-.325.851-.42l.322-.988A.25.25 0 0 1 11.679 7h.642a.25.25 0 0 1 .238.173l.322.988c.308.095.594.237.851.42l.938-.36a.25.25 0 0 1 .283.076l.405.5a.25.25 0 0 1 .015.293l-.568.875c.113.297.18.616.193.95l.898.54a.25.25 0 0 1 .115.27l-.144.626a.25.25 0 0 1-.222.193l-1.115.098a3.015 3.015 0 0 1-.512.608l.165 1.18a.25.25 0 0 1-.138.259l-.577.281a.25.25 0 0 1-.29-.05l-.874-.905a3.035 3.035 0 0 1-.608 0l-.875.904a.25.25 0 0 1-.289.051l-.577-.281a.25.25 0 0 1-.138-.26l.165-1.18a3.015 3.015 0 0 1-.512-.607l-1.115-.098a.25.25 0 0 1-.222-.193l-.144-.626a.25.25 0 0 1 .115-.27l.898-.54c.013-.334.08-.653.193-.95zM6.789 8.023A12.845 12.845 0 0 0 6 8c-5.036 0-6 2.74-6 4.48C0 14.22.076 15 6 15c.553 0 1.055-.006 1.51-.02A5.977 5.977 0 0 1 6 11c0-1.083.287-2.1.79-2.977zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM12 12a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="admin" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.162 2.5a3.5 3.5 0 0 1-3.163 5.479L6.08 14.766a1.5 1.5 0 0 1-2.598-1.5L7.4 6.479A3.5 3.5 0 0 1 10.564 1L8.9 3.88l2.599 1.5 1.663-2.88zm-8.63 11.949a.5.5 0 1 0 .5-.866.5.5 0 0 0-.5.866z"/></symbol><symbol viewBox="0 0 16 16" id="angle-double-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.414 7.95l4.243-4.243a1 1 0 0 0-1.414-1.414l-4.95 4.95a.997.997 0 0 0 0 1.414l4.95 4.95a1 1 0 1 0 1.414-1.415L10.414 7.95zm-7 0l4.243-4.243a1 1 0 0 0-1.414-1.414l-4.95 4.95a.997.997 0 0 0 0 1.414l4.95 4.95a1 1 0 0 0 1.414-1.415L3.414 7.95z"/></symbol><symbol viewBox="0 0 16 16" id="angle-double-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.535 7.95L1.292 3.707a1 1 0 0 1-.281-.695 1 1 0 1 1 1.695-.719l4.95 4.95a.998.998 0 0 1 0 1.414l-4.95 4.95a1.002 1.002 0 0 1-.707.293c-.549 0-1-.452-1-1 0-.266.106-.52.293-.708L5.535 7.95zm7 0L8.292 3.707a1 1 0 0 1-.281-.695 1 1 0 1 1 1.695-.719l4.95 4.95a.998.998 0 0 1 0 1.414l-4.95 4.95a1.002 1.002 0 0 1-.707.293c-.549 0-1-.452-1-1.001 0-.265.106-.519.293-.707l4.243-4.242z"/></symbol><symbol viewBox="0 0 16 16" id="angle-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 10.243l-4.95-4.95a1 1 0 0 0-1.414 1.414l5.657 5.657a.997.997 0 0 0 1.414 0l5.657-5.657a1 1 0 0 0-1.414-1.414L8 10.243z"/></symbol><symbol viewBox="0 0 16 16" id="angle-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.757 8l4.95-4.95a1 1 0 1 0-1.414-1.414L3.636 7.293a.997.997 0 0 0 0 1.414l5.657 5.657a1 1 0 0 0 1.414-1.414L5.757 8z"/></symbol><symbol viewBox="0 0 16 16" id="angle-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.243 8l-4.95-4.95a1 1 0 0 1 1.414-1.414l5.657 5.657a.997.997 0 0 1 0 1.414l-5.657 5.657a1 1 0 0 1-1.414-1.414L10.243 8z"/></symbol><symbol viewBox="0 0 16 16" id="angle-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 6.757l-4.95 4.95a1 1 0 1 1-1.414-1.414l5.657-5.657a.997.997 0 0 1 1.414 0l5.657 5.657a1 1 0 0 1-1.414 1.414L8 6.757z"/></symbol><symbol viewBox="0 0 16 16" id="appearance" xmlns="http://www.w3.org/2000/svg"><path d="M11.161 12.456l.232.121c.1.053.175.094.249.137.53.318.844.75.857 1.402.012 1.397-1.116 1.756-3.12 1.858a23.85 23.85 0 0 1-1.38.026A8 8 0 0 1 0 8a8 8 0 0 1 8-8c4.417 0 7.998 3.582 7.998 7.977.06 2.621-1.312 3.586-4.48 3.648-.602.008-1.068.043-1.4.104.228.192.598.47 1.043.727zm-3.287-.943c-.019-1.495 1.228-1.856 3.611-1.888C13.67 9.582 14.028 9.33 13.998 8A6 6 0 1 0 8 14c.603 0 .91-.004 1.277-.023a9.7 9.7 0 0 0 .478-.035c-1.172-.738-1.868-1.47-1.88-2.43zM6 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm-2-3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zM4 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="applications" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 0h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm6-6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 1v2h2V1H7zm0 5h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm6-6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm0 1v2h2V7h-2zM1 12h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1zm0 1v2h2v-2H1zm6-1h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1zm6 0h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="approval" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.536 10.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 1 1 9.12 9.243l1.415 1.414zM7.632 8.109A2 2 0 0 0 7 11.364l2.121 2.121a1.996 1.996 0 0 0 2.807.021C11.686 14.554 10.627 15 6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8c.6 0 1.142.038 1.632.109zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="arrow-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 6H2a2 2 0 1 0 0 4h7v2.586a1 1 0 0 0 1.707.707l4.586-4.586a1 1 0 0 0 0-1.414l-4.586-4.586A1 1 0 0 0 9 3.414V6z"/></symbol><symbol viewBox="0 0 16 16" id="assignee" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12 5V4a1 1 0 0 1 2 0v1h1a1 1 0 0 1 0 2h-1v1a1 1 0 0 1-2 0V7h-1a1 1 0 0 1 0-2h1zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="bold" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 15V1a1 1 0 0 1 1-1h4.604c.93 0 1.762.088 2.495.264.733.176 1.353.445 1.863.807.509.363.897.82 1.164 1.369.268.549.401 1.197.401 1.945 0 .366-.045.718-.137 1.055-.091.337-.23.652-.417.945a3.453 3.453 0 0 1-.71.796 3.645 3.645 0 0 1-1.021.588c.469.117.87.295 1.203.533.333.238.608.515.824.83.216.315.374.657.473 1.027.099.37.148.75.148 1.138 0 1.553-.5 2.725-1.5 3.516-1 .791-2.423 1.187-4.27 1.187H3a1 1 0 0 1-1-1zm3.297-5.967v4.319H8.12c.425 0 .791-.053 1.099-.16.307-.106.564-.252.769-.44.205-.186.357-.406.456-.659.099-.252.148-.529.148-.83a3.04 3.04 0 0 0-.131-.928 1.78 1.78 0 0 0-.413-.703 1.8 1.8 0 0 0-.73-.445c-.3-.103-.66-.154-1.077-.154H5.297zm0-2.33h2.44c.842-.014 1.468-.192 1.878-.533.41-.34.616-.826.616-1.456 0-.725-.21-1.247-.632-1.566-.421-.318-1.086-.478-1.995-.478H5.297v4.033z"/></symbol><symbol viewBox="0 0 16 16" id="book" xmlns="http://www.w3.org/2000/svg"><path d="M7 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2v4.191a.5.5 0 0 1-.724.447l-1.052-.526a.5.5 0 0 0-.448 0l-1.052.526A.5.5 0 0 1 7 6.191V2zM5 0h6a4 4 0 0 1 4 4v8a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4z"/></symbol><symbol viewBox="0 0 16 16" id="branch" xmlns="http://www.w3.org/2000/svg"><path d="M6 11.978v.29a2 2 0 1 1-2 0V3.732a2 2 0 1 1 2 0v3.849c.592-.491 1.31-.854 2.15-1.081 1.308-.353 1.875-.882 1.893-1.743a2 2 0 1 1 2.002-.051C12.053 6.54 10.857 7.84 8.67 8.43 7.056 8.867 6.195 9.98 6 11.978zM5 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm6 1a1 1 0 1 0 0-2 1 1 0 0 0 0 2zM5 15a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="calendar" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12 2h2a2 2 0 0 1 2 2H0a2 2 0 0 1 2-2h2V1a1 1 0 1 1 2 0v1h4V1a1 1 0 1 1 2 0v1zM0 4h16v9a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V4zm2 2.5V13a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6.5a.5.5 0 0 0-.5-.5h-11a.5.5 0 0 0-.5.5zM5 8h2a1 1 0 1 1 0 2H5a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="cancel" xmlns="http://www.w3.org/2000/svg"><path d="M3.11 4.523a6 6 0 0 0 8.367 8.367L3.109 4.524zM4.522 3.11l8.368 8.368A6 6 0 0 0 4.524 3.11zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.078 8.2l3.535-3.536a2 2 0 0 1 2.828 2.828l-4.949 4.95c-.39.39-.902.586-1.414.586a1.994 1.994 0 0 1-1.414-.586l-4.95-4.95a2 2 0 1 1 2.828-2.828l3.536 3.535z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.977 7.998l3.535-3.535a2 2 0 1 0-2.828-2.828l-4.95 4.949c-.39.39-.586.902-.586 1.414 0 .512.196 1.024.586 1.414l4.95 4.95a2 2 0 1 0 2.828-2.828L7.977 7.998z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.22 7.998L4.683 4.463a2 2 0 0 1 2.828-2.828l4.95 4.949c.39.39.586.902.586 1.414a1.99 1.99 0 0 1-.586 1.414l-4.95 4.95a2 2 0 0 1-2.828-2.828l3.535-3.536z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.778 8.957l3.535 3.535a2 2 0 1 0 2.828-2.828l-4.949-4.95a1.994 1.994 0 0 0-1.414-.586c-.512 0-1.024.196-1.414.586l-4.95 4.95a2 2 0 1 0 2.828 2.828l3.536-3.535z"/></symbol><symbol viewBox="0 0 16 16" id="clock" xmlns="http://www.w3.org/2000/svg"><path d="M9 7h1a1 1 0 0 1 0 2H8a.997.997 0 0 1-1-1V5a1 1 0 1 1 2 0v2zm-1 9A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="close" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9.414 8l4.95-4.95a1 1 0 0 0-1.414-1.414L8 6.586l-4.95-4.95A1 1 0 0 0 1.636 3.05L6.586 8l-4.95 4.95a1 1 0 1 0 1.414 1.414L8 9.414l4.95 4.95a1 1 0 1 0 1.414-1.414L9.414 8z"/></symbol><symbol viewBox="0 0 16 16" id="code" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M15.871 8.243a.997.997 0 0 0-.293-.707L12.75 4.707a1 1 0 0 0-1.414 1.414l2.12 2.122-2.12 2.121a1 1 0 0 0 1.414 1.414l2.828-2.828a.997.997 0 0 0 .293-.707zm-13.243 0L4.75 6.12a1 1 0 1 0-1.414-1.414L.507 7.536a.997.997 0 0 0 0 1.414l2.829 2.828a1 1 0 1 0 1.414-1.414L2.628 8.243zm6.407-4.107a1 1 0 0 1 .707 1.225L8.19 11.157a1 1 0 1 1-1.931-.518L7.81 4.843a1 1 0 0 1 1.224-.707z"/></symbol><symbol viewBox="0 0 16 16" id="comment" xmlns="http://www.w3.org/2000/svg"><path d="M1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586z"/></symbol><symbol viewBox="0 0 16 16" id="comment-dots" xmlns="http://www.w3.org/2000/svg"><path d="M1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586zM5 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="comment-next" xmlns="http://www.w3.org/2000/svg"><path d="M8 5V4a.5.5 0 0 1 .8-.4l2.667 2a.5.5 0 0 1 0 .8L8.8 8.4A.5.5 0 0 1 8 8V7H6a1 1 0 1 1 0-2h2zM1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586z"/></symbol><symbol viewBox="0 0 16 16" id="comments" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3.75 10L0 13V3a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2H3.75zM13 5h1a2 2 0 0 1 2 2v8l-2.667-2H8a2 2 0 0 1-2-2h4a3 3 0 0 0 3-3V5z"/></symbol><symbol viewBox="0 0 16 16" id="commit" xmlns="http://www.w3.org/2000/svg"><path d="M8 10a2 2 0 1 0 0-4 2 2 0 0 0 0 4zm3.876-1.008a4.002 4.002 0 0 1-7.752 0A1.01 1.01 0 0 1 4 9H1a1 1 0 1 1 0-2h3c.042 0 .083.003.124.008a4.002 4.002 0 0 1 7.752 0A1.01 1.01 0 0 1 12 7h3a1 1 0 0 1 0 2h-3a1.01 1.01 0 0 1-.124-.008z"/></symbol><symbol viewBox="0 0 16 16" id="credit-card" xmlns="http://www.w3.org/2000/svg"><path d="M14 5a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1h12zm0 3H2v3a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V8zM3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm6.5 8h3a.5.5 0 1 1 0 1h-3a.5.5 0 1 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="disk" xmlns="http://www.w3.org/2000/svg"><path d="M16 11.764V3a3 3 0 0 0-3-3H3a3 3 0 0 0-3 3v8.764A2.989 2.989 0 0 1 2 11V3a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v8c.768 0 1.47.289 2 .764zM2 12h12a2 2 0 1 1 0 4H2a2 2 0 1 1 0-4zm10 1a1 1 0 1 0 0 2 1 1 0 0 0 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="doc_code" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zm1.036 7.607a.498.498 0 0 1-.147.354l-1.414 1.414a.5.5 0 0 1-.707-.707l1.06-1.06-1.06-1.061a.5.5 0 0 1 .707-.707l1.414 1.414a.498.498 0 0 1 .147.353zm-4.822 0l1.06 1.061a.5.5 0 0 1-.706.707l-1.414-1.414a.498.498 0 0 1 0-.707l1.414-1.414a.5.5 0 1 1 .707.707l-1.06 1.06zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4z"/></symbol><symbol viewBox="0 0 16 16" id="doc_image" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zM7.333 9.667l1.313-1.313a.5.5 0 0 1 .708 0L12 11H4l2.188-1.75a.5.5 0 0 1 .624 0l.521.417zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4zm.5 8a1.5 1.5 0 1 1 0-3 1.5 1.5 0 0 1 0 3zM4 11h8v.7a.3.3 0 0 1-.3.3H4.3a.3.3 0 0 1-.3-.3V11z"/></symbol><symbol viewBox="0 0 16 16" id="doc_text" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4zm.5 11h5a.5.5 0 1 1 0 1h-5a.5.5 0 1 1 0-1zm0-2h5a.5.5 0 1 1 0 1h-5a.5.5 0 0 1 0-1zm0-2h2a.5.5 0 0 1 0 1h-2a.5.5 0 0 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="download" xmlns="http://www.w3.org/2000/svg"><path d="M9 12h1a.5.5 0 0 1 .4.8l-2 2.667a.5.5 0 0 1-.8 0l-2-2.667A.5.5 0 0 1 6 12h1V8a1 1 0 1 1 2 0v4zM4 9a1 1 0 1 1 0 2 4 4 0 0 1-1.971-7.481 4 4 0 0 1 6.633-2.505 3.999 3.999 0 0 1 3.82 2.014A4 4 0 0 1 12 11a1 1 0 0 1 0-2 2 2 0 1 0 0-4h-1a2 2 0 0 0-3.112-1.662A2 2 0 1 0 4.268 5H4a2 2 0 1 0 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="duplicate" xmlns="http://www.w3.org/2000/svg"><path d="M14 10h-3a1 1 0 0 1-1-1V6H8.527A.527.527 0 0 0 8 6.527V13a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1v-3zm-4-7H8.527c-.18 0-.355.013-.527.04V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v6a1 1 0 0 0 1 1h2v2H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h4a3 3 0 0 1 3 3zM8.527 4h2.323a.5.5 0 0 1 .35.143l4.65 4.551a.5.5 0 0 1 .15.357V13a3 3 0 0 1-3 3H9a3 3 0 0 1-3-3V6.527A2.527 2.527 0 0 1 8.527 4z"/></symbol><symbol viewBox="0 0 16 16" id="earth" xmlns="http://www.w3.org/2000/svg"><path d="M8.7 2.04l-.082.177c.283.223.422.413.417.571-.008.237-.311.057-.444.274-.133.218.038.542-.112.637-.15.096-.398-.386-.479-.46-.054-.049-.166-.257-.336-.625l-.216-.225a.844.844 0 0 0-.418-.035c-.177.038-.075.1-.035.132.04.032.32.037.452.2.132.164.03.224-.05.298-.054.05-.157.062-.31.035H5.952l-.402.398.03.325.229.455.324-.463c.008-.206.058-.342.15-.41.14-.1.342-.15.534-.085.191.066-.057.218.011.271.068.053.204-.098.313-.02.11.08.07.155.104.322.036.167.254.114.398.328.144.215.19.29.147.483-.043.195-.168.26-.305.232-.138-.028-.107-.246-.275-.348-.168-.102-.266-.114-.386-.054-.12.06-.016.129.023.235.04.106.274.321.224.43-.05.107-.108.116-.42 0-.21-.077-.414-.007-.615.212l-.76.722c-.153.715-.3 1.13-.44 1.243-.211.17-.177-.483-.483-.656-.306-.174-.494-.047-.8-.07-.307-.023-.42.65-.38.873a.434.434 0 0 0 .221.321c.236-.141.39-.184.465-.128.11.084-.144.267-.074.425.07.158.314.069.386.283.073.213.084.48-.05.706-.135.227-.275.178-.4.053-.127-.126-.033-.375-.255-.704-.223-.329-.381-.337-.63-.787-.158-.287-.35-.743-.575-1.366a6 6 0 0 0 3.21 7.198l.001-.075c0-.577-.004-.944-.012-1.102-.011-.236-.95-.945-1.104-1.2-.154-.256-.34-.595-.355-.746-.016-.151.185-.232.344-.325.16-.093-.11-.367.028-.626.137-.258.395-.438.496-.356.101.081.058.228.267.333.209.104.077-.213.456-.178.38.035.143.201.252.216.11.016.113-.127.299-.143.186-.015.282.445.471.622.19.178.452.008.611.043.159.034.267.09.402.255.136.166-.03.352.073.557.103.205 1.07.22 1.433.255.364.034.371.011.371.324s-.166.314-.453.507c-.286.193-.166.462-.38.762-.212.3-.316.062-.622.14-.306.077-.413.382-.452.568-.039.186-.386.094-.877.232-.29.082-.429.144-.569.204a6.002 6.002 0 0 0 7.682-4.3c-.094-.384-.18-.63-.258-.74-.213-.297-.36.21-.924.49-.564.278-.57-.288-.81-.49-.16-.133-.212-.44-.158-.92-.005-.478.02-.828.077-1.049.057-.221.126-.543.207-.965.351-.373.606-.572.764-.595.237-.034.336.374.658.3a.315.315 0 0 0 .035-.01 5.993 5.993 0 0 0-.475-.824l-.309-.043a.646.646 0 0 0-.332-.117c-.205-.02-.025.128-.089.24-.064.112-.235.724-.437.685-.201-.039-.204-.374-.17-.668.036-.294-.077-.35-.2-.412-.124-.062-.325-.213-.556-.295-.232-.082-.123-.175-.093-.274.03-.1.208-.015.193-.058-.014-.044-.313-.135-.266-.167.03-.02.2-.02.506.003l.216-.012.293-.163a.58.58 0 0 0-.376-.22c-.233-.036-.513-.034-.73-.142-.205-.103-.458-.36-.643-.638A5.965 5.965 0 0 0 8.7 2.04zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16z"/></symbol><symbol viewBox="0 0 16 16" id="eye" xmlns="http://www.w3.org/2000/svg"><path d="M8 14C4.816 14 2.253 12.284.393 8.981a2 2 0 0 1 0-1.962C2.253 3.716 4.816 2 8 2s5.747 1.716 7.607 5.019a2 2 0 0 1 0 1.962C13.747 12.284 11.184 14 8 14zm0-2c2.41 0 4.338-1.29 5.864-4C12.338 5.29 10.411 4 8 4 5.59 4 3.662 5.29 2.136 8 3.662 10.71 5.589 12 8 12zm0-1a3 3 0 1 1 0-6 3 3 0 0 1 0 6zm1-3a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="eye-slash" xmlns="http://www.w3.org/2000/svg"><path d="M13.618 2.62L1.62 14.619a1 1 0 0 1-.985-1.668l1.525-1.526C1.516 10.742.926 9.927.393 8.981a2 2 0 0 1 0-1.962C2.253 3.716 4.816 2 8 2c1.074 0 2.076.195 3.006.58l.944-.944a1 1 0 0 1 1.668.985zM8.068 11a3 3 0 0 0 2.931-2.932l-2.931 2.931zm-3.02-2.462a3 3 0 0 1 3.49-3.49l.884-.884A6.044 6.044 0 0 0 8 4C5.59 4 3.662 5.29 2.136 8c.445.79.924 1.46 1.439 2.011l1.473-1.473zm.421 5.06l1.658-1.658c.283.04.575.06.873.06 2.41 0 4.338-1.29 5.864-4a11.023 11.023 0 0 0-1.133-1.664l1.418-1.418a12.799 12.799 0 0 1 1.458 2.1 2 2 0 0 1 0 1.963C13.747 12.284 11.184 14 8 14a7.883 7.883 0 0 1-2.53-.402z"/></symbol><symbol viewBox="0 0 16 16" id="file-additions" xmlns="http://www.w3.org/2000/svg"><path d="M7 7V5a1 1 0 1 1 2 0v2h2a1 1 0 0 1 0 2H9v2a1 1 0 0 1-2 0V9H5a1 1 0 1 1 0-2h2zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3z"/></symbol><symbol viewBox="0 0 16 16" id="file-deletion" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3zm2 6h6a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="file-modified" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3zm5 4a3 3 0 1 1 0 6 3 3 0 0 1 0-6z"/></symbol><symbol viewBox="0 0 16 16" id="filter" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 6v9l-3.724-1.862A.5.5 0 0 1 6 12.691V6L1.854 1.854A.5.5 0 0 1 2.207 1h11.586a.5.5 0 0 1 .353.854L10 6z"/></symbol><symbol viewBox="0 0 16 16" id="folder" xmlns="http://www.w3.org/2000/svg"><path d="M7.228 5l-.475-1.335A1 1 0 0 0 5.81 3H2v9a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6a1 1 0 0 0-1-1H7.228zM13 3a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a2 2 0 0 1 2-2h3.81a3 3 0 0 1 2.827 1.995L13 3z"/></symbol><symbol viewBox="0 0 16 16" id="fork" xmlns="http://www.w3.org/2000/svg"><path d="M9 12.268a2 2 0 1 1-2 0V8.874A4.002 4.002 0 0 1 4 5V3.732a2 2 0 1 1 2 0V5a2 2 0 1 0 4 0V3.732a2 2 0 1 1 2 0V5a4.002 4.002 0 0 1-3 3.874v3.394zM11 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zM5 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm3 12a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="geo-nodes" xmlns="http://www.w3.org/2000/svg"><path d="M9.7 13.1l-.2.2c-.7.8-2 .9-2.8.1-.1 0-.1-.1-.1-.1l-.2-.2c-2 .2-3.4.7-3.4 1.4 0 .8 2.2 1.5 5 1.5s5-.7 5-1.5c0-.7-1.4-1.2-3.3-1.4M7.3 12.7c.4.4 1 .3 1.4-.1C11.6 9.5 13 7 13 5.3 13 2.4 10.8 0 8 0S3 2.4 3 5.3C3 7 4.4 9.5 7.3 12.7M8 2c1.6 0 3 1.4 3 3.3 0 1-1 2.8-3 5.2-2-2.4-3-4.2-3-5.2C5 3.4 6.4 2 8 2"/><circle cx="8" cy="5" r="1"/></symbol><symbol viewBox="0 0 16 16" id="git-merge" xmlns="http://www.w3.org/2000/svg"><path d="M11 12.268V5a1 1 0 0 0-1-1v1a.5.5 0 0 1-.8.4l-2.667-2a.5.5 0 0 1 0-.8L9.2.6a.5.5 0 0 1 .8.4v1a3 3 0 0 1 3 3v7.268a2 2 0 1 1-2 0zm-6 0a2 2 0 1 1-2 0V4.732a2 2 0 1 1 2 0v7.536zM4 4a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm0 11a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm8 0a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="group" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3.048 11.997C-.377 11.975.013 11.782.013 10.56.013 9.235.653 8 4 8c.444 0 .84.022 1.194.062.164.435.426.82.76 1.132-1.786.389-2.721 1.353-2.906 2.803zm2.94-7.222a2.993 2.993 0 0 0-.976 1.95 2 2 0 1 1 .975-1.95zm6.964 7.222c-.185-1.45-1.12-2.414-2.906-2.803.334-.311.596-.697.76-1.132C11.16 8.022 11.556 8 12 8c3.346 0 3.987 1.235 3.987 2.56 0 1.222.39 1.415-3.035 1.437zm-1.964-5.272a2.993 2.993 0 0 0-.976-1.95 2 2 0 1 1 .976 1.95zM8 9a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 5c-2.177 0-3.987-.115-3.987-1.44S4.653 10 8 10c3.346 0 3.987 1.235 3.987 2.56S10.177 14 8 14z"/></symbol><symbol viewBox="0 0 16 16" id="history" xmlns="http://www.w3.org/2000/svg"><path d="M2.868 3.24a7 7 0 1 1-.043 9.475 1 1 0 0 1 1.478-1.348 5 5 0 1 0 .124-6.865l.796.645a.5.5 0 0 1-.193.873l-3.232.814a.5.5 0 0 1-.622-.504L1.3 3a.5.5 0 0 1 .814-.37l.754.61zM9 8h1a1 1 0 0 1 0 2H8a.997.997 0 0 1-1-1V6a1 1 0 1 1 2 0v2z"/></symbol><symbol viewBox="0 0 16 16" id="home" xmlns="http://www.w3.org/2000/svg"><path d="M8.462 2.177a.505.505 0 0 1-.038.044l.038-.044zm-.787 0l.038.043a.5.5 0 0 1-.038-.043zM3.706 7h8.725L8.069 2.585 3.706 7zM7 13.369V12a1 1 0 0 1 2 0v1.369h3V9H4v4.369h3zM14 9v4.836c0 .833-.657 1.533-1.5 1.533h-9c-.843 0-1.5-.7-1.5-1.533V9h-.448a1.1 1.1 0 0 1-.783-1.873L6.934.887a1.5 1.5 0 0 1 2.269 0l6.165 6.24A1.1 1.1 0 0 1 14.585 9H14z"/></symbol><symbol viewBox="0 0 16 16" id="hook" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 3a1 1 0 0 0-1-1H7a1 1 0 0 0-1 1h4zm0 1H6v1a1 1 0 0 0 1 1h2a1 1 0 0 0 1-1V4zM7 8a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h2a3 3 0 0 1 3 3v2a3 3 0 0 1-3 3v4a2 2 0 1 0 4 0h-.44a.3.3 0 0 1-.25-.466l1.44-2.16a.3.3 0 0 1 .5 0l1.44 2.16a.3.3 0 0 1-.25.466H15a4 4 0 0 1-7 2.646A4 4 0 0 1 1 12H.56a.3.3 0 0 1-.25-.466l1.44-2.16a.3.3 0 0 1 .5 0l1.44 2.16a.3.3 0 0 1-.25.466H3a2 2 0 1 0 4 0V8z"/></symbol><symbol viewBox="0 0 16 16" id="issue-block" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.803 8a5.97 5.97 0 0 0-.462 1H4.5a.5.5 0 0 1 0-1h1.303zM4.5 5h3a.5.5 0 0 1 0 1h-3a.5.5 0 0 1 0-1zm7.5.083a6.04 6.04 0 0 0-2 0V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h2.083a5.96 5.96 0 0 0 .72 2H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h6a3 3 0 0 1 3 3v2.083zm1.121 3.796zM11 16a5 5 0 1 1 0-10 5 5 0 0 1 0 10zm-1.293-2.292a3 3 0 0 0 4.001-4.001l-4.001 4zm-1.415-1.415l4.001-4a3 3 0 0 0-4.001 4.001z"/></symbol><symbol viewBox="0 0 16 16" id="issue-child" xmlns="http://www.w3.org/2000/svg"><path d="M11 8H5v1h1a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1v-4a1 1 0 0 1 1-1h2V7a.997.997 0 0 1 1-1h3V4H4.5a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5h7a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5H9v2h3a.997.997 0 0 1 1 1v2h2a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-5a1 1 0 0 1-1-1v-4a1 1 0 0 1 1-1h1V8zm-9 3v2h3v-2H2zm9 0v2h3v-2h-3z"/></symbol><symbol viewBox="0 0 16 16" id="issue-close" xmlns="http://www.w3.org/2000/svg"><path d="M7.536 8.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 0 1 6.12 7.243l1.415 1.414zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="issue-duplicate" xmlns="http://www.w3.org/2000/svg"><path d="M10.874 2H12a3 3 0 0 1 3 3v8a3 3 0 0 1-3 3h-2c-.918 0-1.74-.413-2.29-1.063a3.987 3.987 0 0 0 1.988-.984A1 1 0 0 0 10 14h2a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1h-1V3c0-.345-.044-.68-.126-1zM4 0h3a3 3 0 0 1 3 3v8a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H4z"/></symbol><symbol viewBox="0 0 16 16" id="issue-new" xmlns="http://www.w3.org/2000/svg"><path d="M10 2V1a1 1 0 0 1 2 0v1h1a1 1 0 0 1 0 2h-1v1a1 1 0 0 1-2 0V4H9a1 1 0 1 1 0-2h1zm0 6a1 1 0 0 1 2 0v5a3 3 0 0 1-3 3H5a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h1a1 1 0 1 1 0 2H5a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V8z"/></symbol><symbol viewBox="0 0 16 16" id="issue-open" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm0-2a4 4 0 1 1 0-8 4 4 0 0 1 0 8zm0-2a2 2 0 1 0 0-4 2 2 0 0 0 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="issue-open-m" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="issue-parent" xmlns="http://www.w3.org/2000/svg"><path d="M11 11H5v1h1.5a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5h-6a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5H3v-2a.997.997 0 0 1 1-1h3V7H5a1 1 0 0 1-1-1V2a1 1 0 0 1 1-1h6a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H9v2h3a.997.997 0 0 1 1 1v2h2.5a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5h-6a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5H11v-1zM6 3v2h4V3H6z"/></symbol><symbol viewBox="0 0 16 16" id="issues" xmlns="http://www.w3.org/2000/svg"><path d="M10.458 15.012l.311.055a3 3 0 0 0 3.476-2.433l1.389-7.879A3 3 0 0 0 13.2 1.28L11.23.933a3.002 3.002 0 0 0-.824-.031c.364.59.58 1.28.593 2.02l1.854.328a1 1 0 0 1 .811 1.158l-1.389 7.879a1 1 0 0 1-1.158.81l-.118-.02a3.98 3.98 0 0 1-.541 1.935zM3 0h4a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="key" xmlns="http://www.w3.org/2000/svg"><path d="M7.575 6.689a4.002 4.002 0 0 1 6.274-4.86 4 4 0 0 1-4.86 6.274l-2.21 2.21.706.708a1 1 0 1 1-1.414 1.414l-.707-.707-.707.707.707.707a1 1 0 1 1-1.414 1.414l-.707-.707a1 1 0 0 1-1.414-1.414l5.746-5.746zm2.032-.618a2 2 0 1 0 2.828-2.828A2 2 0 0 0 9.607 6.07z"/></symbol><symbol viewBox="0 0 16 16" id="key-2" xmlns="http://www.w3.org/2000/svg"><path d="M5.172 14.157l-.344.344-2.485.133a.462.462 0 0 1-.497-.503l.14-2.24a.599.599 0 0 1 .177-.382l5.155-5.155a4 4 0 1 1 2.828 2.828l-1.439 1.44-1.06-.354-.708.707.354 1.06-.707.708-1.06-.354-.708.707.354 1.06zm6.01-8.839a1 1 0 1 0 1.414-1.414 1 1 0 0 0-1.414 1.414z"/></symbol><symbol viewBox="0 0 16 16" id="label" xmlns="http://www.w3.org/2000/svg"><path d="M11.782 14.718a3 3 0 0 1-4.242 0L1.652 8.829a2 2 0 0 1-.565-1.702l.54-3.703a2 2 0 0 1 1.69-1.69l3.703-.54a2 2 0 0 1 1.703.564l5.888 5.888a3 3 0 0 1 0 4.243l-2.829 2.829zm1.415-5.657L7.309 3.173l-3.703.54-.54 3.702 5.888 5.888a1 1 0 0 0 1.414 0l2.829-2.828a1 1 0 0 0 0-1.414zM5.732 5.525A1 1 0 1 1 7.146 6.94a1 1 0 0 1-1.414-1.414z"/></symbol><symbol viewBox="0 0 16 16" id="labels" xmlns="http://www.w3.org/2000/svg"><path d="M9.424 2.254l2.08-.905a1 1 0 0 1 1.206.326l3.013 4.12a1 1 0 0 1 .16.849l-1.947 7.264a3 3 0 0 1-3.675 2.122l-.5-.135a3.999 3.999 0 0 0 1.082-1.782 1 1 0 0 0 1.16-.722l1.823-6.802-2.258-3.087-.687.299a2 2 0 0 0-.628-.88l-.829-.667zM.377 3.7L4.4.498a1 1 0 0 1 1.25.003L9.627 3.7a1 1 0 0 1 .373.78V13a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V4.482A1 1 0 0 1 .377 3.7zM2 13a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V4.958L5.02 2.561 2 4.964V13zm3-6a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="leave" xmlns="http://www.w3.org/2000/svg"><path d="M11 7V5.883a.5.5 0 0 1 .757-.429l3.528 2.117a.5.5 0 0 1 0 .858l-3.528 2.117a.5.5 0 0 1-.757-.43V9H7a1 1 0 1 1 0-2h4zm-2 6.256a1 1 0 0 1 2 0A2.744 2.744 0 0 1 8.256 16H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h5.19A2.81 2.81 0 0 1 11 2.81a1 1 0 0 1-2 0A.81.81 0 0 0 8.19 2H3a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h5.256c.41 0 .744-.333.744-.744z"/></symbol><symbol viewBox="0 0 16 16" id="level-up" xmlns="http://www.w3.org/2000/svg"><path fill="#2E2E2E" fill-rule="evenodd" d="M7 6h3.489a.5.5 0 0 0 .373-.832L6.374.117a.5.5 0 0 0-.748 0l-4.488 5.05A.5.5 0 0 0 1.51 6H5v7a3 3 0 0 0 3 3h6a1 1 0 0 0 0-2H8a1 1 0 0 1-1-1V6z"/></symbol><symbol viewBox="0 0 16 16" id="license" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12.56 8.9l2.66 4.606a.3.3 0 0 1-.243.45l-1.678.094a.1.1 0 0 0-.078.044l-.953 1.432a.3.3 0 0 1-.51-.016L9.097 10.9a5.994 5.994 0 0 0 3.464-2zm-5.23 2.063L4.707 15.51a.3.3 0 0 1-.51.016l-.953-1.432a.1.1 0 0 0-.078-.044l-1.678-.094a.3.3 0 0 1-.243-.45l2.48-4.297a5.983 5.983 0 0 0 3.607 1.754zM8 10A5 5 0 1 1 8 0a5 5 0 0 1 0 10zm0-2a3 3 0 1 0 0-6 3 3 0 0 0 0 6zm0-1a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="link" xmlns="http://www.w3.org/2000/svg"><path d="M6.986 3.35l2.12-2.122a4 4 0 0 1 5.657 5.657l-2.828 2.829a4 4 0 0 1-5.657 0 1 1 0 0 1 1.414-1.415 2 2 0 0 0 2.829 0l2.828-2.828a2 2 0 1 0-2.828-2.828l-1.001 1a5.018 5.018 0 0 0-2.534-.294zm2.12 9.192l-2.12 2.121a4 4 0 1 1-5.658-5.656l2.829-2.829a4 4 0 0 1 5.657 0 1 1 0 1 1-1.415 1.414 2 2 0 0 0-2.828 0l-2.828 2.829a2 2 0 1 0 2.828 2.828l1.001-1.001a5.018 5.018 0 0 0 2.534.294z"/></symbol><symbol viewBox="0 0 16 16" id="list-bulleted" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 4a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm0 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4-7h10a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2zm0 5h10a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2zm-4 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4-2h10a1 1 0 0 1 0 2H5a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="list-numbered" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 2h8a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm0 5h8a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm0 5h8a1 1 0 0 1 0 2H6a1 1 0 0 1 0-2zM1.156 5v-.828h.816V2.204h-.72v-.636c.432-.084.708-.192.996-.372h.756v2.976h.684V5H1.156zm-.18 5v-.588c.9-.828 1.596-1.464 1.596-1.98 0-.342-.192-.504-.468-.504-.252 0-.444.18-.624.36l-.552-.552c.396-.42.756-.612 1.32-.612.768 0 1.308.492 1.308 1.248 0 .612-.576 1.284-1.092 1.812.192-.024.468-.048.636-.048h.636V10H.976zm1.26 5.072c-.618 0-1.068-.204-1.356-.54l.468-.648c.234.216.51.36.78.36.336 0 .552-.12.552-.36 0-.288-.15-.456-.948-.456v-.72c.636 0 .828-.168.828-.432 0-.228-.138-.348-.396-.348-.252 0-.432.108-.672.312l-.516-.624c.372-.312.768-.492 1.236-.492.84 0 1.38.384 1.38 1.074 0 .366-.204.642-.612.822v.024c.432.132.732.432.732.912 0 .72-.684 1.116-1.476 1.116z"/></symbol><symbol viewBox="0 0 16 16" id="location" xmlns="http://www.w3.org/2000/svg"><path d="M8.755 15.144a1 1 0 0 1-1.51 0C3.748 11.114 2 8.065 2 6a6 6 0 1 1 12 0c0 2.065-1.748 5.113-5.245 9.144zM12 6a4 4 0 1 0-8 0c0 1.314 1.312 3.71 4 6.944C10.688 9.71 12 7.314 12 6zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="location-dot" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6.314 13.087C4.382 13.295 3 13.85 3 14.5c0 .828 2.239 1.5 5 1.5s5-.672 5-1.5c0-.65-1.382-1.205-3.314-1.413l-.202.225a2 2 0 0 1-2.968 0l-.202-.225zm2.428-.445a1 1 0 0 1-1.484 0C4.419 9.5 3 7.037 3 5.252 3 2.353 5.239 0 8 0s5 2.352 5 5.253c0 1.784-1.42 4.247-4.258 7.389zM11 5.252C11 3.436 9.634 2 8 2S5 3.435 5 5.253c0 1.027.974 2.824 3 5.203 2.026-2.38 3-4.176 3-5.203zM8 6a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="lock" xmlns="http://www.w3.org/2000/svg"><path d="M10 5V4h2v1a3 3 0 0 1 3 3v5a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V8a3 3 0 0 1 3-3V4h2v1h4zM4 7a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V8a1 1 0 0 0-1-1H4zm0-3a4 4 0 1 1 8 0h-2a2 2 0 1 0-4 0H4z"/></symbol><symbol viewBox="0 0 16 16" id="lock-open" xmlns="http://www.w3.org/2000/svg"><path d="M4.044 4a4 4 0 0 1 6.99-2.658 1 1 0 1 1-1.495 1.33A2 2 0 0 0 6.044 4a.998.998 0 0 1-.07.367v.701H12a3 3 0 0 1 3 3v5a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3v-5a3 3 0 0 1 2.974-3V4h.07zM4 7.07a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-5a1 1 0 0 0-1-1H4z"/></symbol><symbol viewBox="0 0 16 16" id="log" xmlns="http://www.w3.org/2000/svg"><path d="M4 0h8a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H4zm1 4a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm0 3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3-5h3a1 1 0 0 1 0 2H8a1 1 0 1 1 0-2zm0 3h3a1 1 0 0 1 0 2H8a1 1 0 1 1 0-2zm-3 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3-2h3a1 1 0 0 1 0 2H8a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="mail" xmlns="http://www.w3.org/2000/svg"><path d="M14 5.6L9.338 9.796a2 2 0 0 1-2.676 0L2 5.6V11a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V5.6zM3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm.212 2L8 8.31 12.788 4H3.212z"/></symbol><symbol viewBox="0 0 16 16" id="merge-request-close" xmlns="http://www.w3.org/2000/svg"><path d="M9.414 8l1.414 1.414a1 1 0 1 1-1.414 1.414L8 9.414l-1.414 1.414a1 1 0 1 1-1.414-1.414L6.586 8 5.172 6.586a1 1 0 1 1 1.414-1.414L8 6.586l1.414-1.414a1 1 0 1 1 1.414 1.414L9.414 8zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="messages" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.588 8.942l1.173 5.862A1 1 0 0 1 8.78 16H7.22a1 1 0 0 1-.98-1.196l1.172-5.862a3.014 3.014 0 0 0 1.176 0zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4zM4.464 2.464L5.88 3.88a3 3 0 0 0 0 4.242L4.464 9.536a5 5 0 0 1 0-7.072zm7.072 7.072L10.12 8.12a3 3 0 0 0 0-4.242l1.415-1.415a5 5 0 0 1 0 7.072zM2.343.343l1.414 1.414a6 6 0 0 0 0 8.486l-1.414 1.414a8 8 0 0 1 0-11.314zm11.314 11.314l-1.414-1.414a6 6 0 0 0 0-8.486L13.657.343a8 8 0 0 1 0 11.314z"/></symbol><symbol viewBox="0 0 16 16" id="mobile-issue-close" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.657 10.728L2.12 7.192A1 1 0 1 0 .707 8.607l4.243 4.242a.997.997 0 0 0 1.414 0l8.485-8.485a1 1 0 1 0-1.414-1.414l-7.778 7.778z"/></symbol><symbol viewBox="0 0 16 16" id="monitor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 13v1h3a1 1 0 0 1 0 2H3a1 1 0 0 1 0-2h3v-1H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v7a3 3 0 0 1-3 3h-3zM3 2a1 1 0 0 0-1 1v7a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3zm5.723 6.416l-2.66-1.773-1.71 1.71a.5.5 0 1 1-.707-.707l2-2a.5.5 0 0 1 .631-.062l2.66 1.773 2.71-2.71a.5.5 0 0 1 .707.707l-3 3a.5.5 0 0 1-.631.062z"/></symbol><symbol viewBox="0 0 16 16" id="more" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 4a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 6a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 6a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="notifications" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 14H2.435a2 2 0 0 1-1.761-2.947c.962-1.788 1.521-3.065 1.68-3.832.322-1.566.947-5.501 4.65-6.134a1 1 0 1 1 1.994-.024c3.755.528 4.375 4.27 4.761 6.043.188.86.742 2.188 1.661 3.982A2 2 0 0 1 13.64 14H10a2 2 0 1 1-4 0zm5.805-6.468c-.325-1.492-.37-1.674-.61-2.288C10.6 3.716 9.742 3 8.07 3c-1.608 0-2.49.718-3.103 2.197-.28.676-.356.982-.654 2.428-.208 1.012-.827 2.424-1.877 4.375H13.64c-.993-1.937-1.6-3.396-1.835-4.468z"/></symbol><symbol viewBox="0 0 16 16" id="notifications-off" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.26 5.089c.243.757.382 1.478.5 2.017.187.86.74 2.188 1.66 3.982A2 2 0 0 1 13.64 14H10a2 2 0 1 1-4 0H4.35l2-2h7.29c-.993-1.937-1.6-3.396-1.835-4.468-.07-.326-.129-.59-.178-.81l1.634-1.633zM10.943 1.75l-1.48 1.48C9.07 3.076 8.612 3 8.069 3c-1.608 0-2.49.718-3.103 2.197-.28.676-.356.982-.654 2.428-.065.317-.17.673-.317 1.073L.45 12.242a1.99 1.99 0 0 1 .224-1.19c.962-1.787 1.521-3.064 1.68-3.831.322-1.566.947-5.501 4.65-6.134a1 1 0 1 1 1.994-.024 4.867 4.867 0 0 1 1.944.688zm2.932-.105a1 1 0 0 1 0 1.415L2.561 14.374a1 1 0 1 1-1.415-1.414L12.46 1.646a1 1 0 0 1 1.414 0z"/></symbol><symbol viewBox="0 0 16 16" id="overview" xmlns="http://www.w3.org/2000/svg"><path d="M2 0h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2zm0 2v3h3V2H2zm9-2h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2h-3a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2zm0 2v3h3V2h-3zM2 9h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v-3a2 2 0 0 1 2-2zm0 2v3h3v-3H2zm9-2h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2h-3a2 2 0 0 1-2-2v-3a2 2 0 0 1 2-2zm0 2v3h3v-3h-3z"/></symbol><symbol viewBox="0 0 16 16" id="pencil" xmlns="http://www.w3.org/2000/svg"><path d="M13.02 1.293l1.414 1.414a1 1 0 0 1 0 1.414L4.119 14.436a1 1 0 0 1-.704.293l-2.407.008L1 12.316a1 1 0 0 1 .293-.71L11.605 1.292a1 1 0 0 1 1.414 0zm-1.416 1.415l-.707.707L12.31 4.83l.707-.707-1.414-1.415zM3.411 13.73l1.123-1.122H3.12v-1.415L2 12.312l.005 1.422 1.406-.005z"/></symbol><symbol viewBox="0 0 16 16" id="pipeline" xmlns="http://www.w3.org/2000/svg"><path d="M8.969 7.25a2 2 0 1 1-1.938 0A1.002 1.002 0 0 1 7 7V5.083a.2.2 0 0 1 .06-.142l.877-.87a.1.1 0 0 1 .141 0l.864.87A.2.2 0 0 1 9 5.083V7c0 .086-.01.17-.031.25zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm4.5-4a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-3a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-2 6a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-5 9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-2 6a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-3a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zM8 10a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="play" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2.765 15.835c-.545.321-1.258.159-1.593-.363A1.075 1.075 0 0 1 1 14.89V1.11C1 .496 1.518 0 2.158 0c.214 0 .424.057.607.165l11.684 6.89c.544.321.714 1.005.38 1.526a1.135 1.135 0 0 1-.38.364l-11.684 6.89z"/></symbol><symbol viewBox="0 0 16 16" id="plus" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7 7V1a1 1 0 1 1 2 0v6h6a1 1 0 0 1 0 2H9v6a1 1 0 0 1-2 0V9H1a1 1 0 1 1 0-2h6z"/></symbol><symbol viewBox="0 0 16 16" id="plus-square" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 7V4a1 1 0 1 0-2 0v3H4a1 1 0 1 0 0 2h3v3a1 1 0 0 0 2 0V9h3a1 1 0 0 0 0-2H9zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3z"/></symbol><symbol viewBox="0 0 16 16" id="plus-square-o" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7 7V5a1 1 0 1 1 2 0v2h2a1 1 0 0 1 0 2H9v2a1 1 0 0 1-2 0V9H5a1 1 0 1 1 0-2h2zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="preferences" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5 12h10a1 1 0 0 1 0 2H5a1 1 0 0 1-2 0v-2a1 1 0 0 1 2 0zm-3 0H1a1 1 0 0 0 0 2h1v-2zm11-5h2a1 1 0 0 1 0 2h-2a1 1 0 0 1-2 0V7a1 1 0 0 1 2 0zm-3 0H1a1 1 0 1 0 0 2h9V7zM6 2h9a1 1 0 0 1 0 2H6a1 1 0 1 1-2 0V2a1 1 0 1 1 2 0zM3 2H1a1 1 0 1 0 0 2h2V2z"/></symbol><symbol viewBox="0 0 16 16" id="profile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-4.274-3.404C4.412 9.709 5.694 9 8 9c2.313 0 3.595.7 4.28 1.586A4.997 4.997 0 0 1 8 13a4.997 4.997 0 0 1-4.274-2.404zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="project" xmlns="http://www.w3.org/2000/svg"><path d="M8.462 2.177l-.038.044a.505.505 0 0 0 .038-.044zm-.787 0a.5.5 0 0 0 .038.043l-.038-.043zM3.706 7h8.725L8.069 2.585 3.706 7zM7 13.369V12a1 1 0 0 1 2 0v1.369h3V9H4v4.369h3zM14 9v4.836c0 .833-.657 1.533-1.5 1.533h-9c-.843 0-1.5-.7-1.5-1.533V9h-.448a1.1 1.1 0 0 1-.783-1.873L6.934.887a1.5 1.5 0 0 1 2.269 0l6.165 6.24A1.1 1.1 0 0 1 14.585 9H14z"/></symbol><symbol viewBox="0 0 16 16" id="push-rules" xmlns="http://www.w3.org/2000/svg"><path d="M6.268 9a2 2 0 0 1 3.464 0H11a1 1 0 0 1 0 2H9.732a2 2 0 0 1-3.464 0H5a1 1 0 0 1 0-2h1.268zM7 2H4a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1h-1v3.515a.3.3 0 0 1-.434.268l-1.432-.716a.3.3 0 0 0-.268 0l-1.432.716A.3.3 0 0 1 7 5.515V2zM4 0h8a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm4 11a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="question" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm-1.46-5.602h2.233a3.97 3.97 0 0 1 .051-.558c.029-.17.073-.326.133-.469.06-.143.14-.28.242-.41.102-.13.228-.263.38-.399.26-.24.504-.467.733-.683a5.03 5.03 0 0 0 .598-.668c.17-.23.302-.477.399-.742a2.66 2.66 0 0 0 .144-.907c0-.505-.083-.95-.25-1.335a2.55 2.55 0 0 0-.723-.97 3.2 3.2 0 0 0-1.152-.589 5.441 5.441 0 0 0-1.531-.2c-.516 0-.998.063-1.445.188a3.19 3.19 0 0 0-1.168.59c-.331.268-.594.61-.79 1.027-.195.417-.295.917-.3 1.5h2.64c.006-.224.04-.416.102-.578.062-.161.142-.293.238-.394a.921.921 0 0 1 .332-.227 1.04 1.04 0 0 1 .39-.074c.34 0 .593.095.763.285.169.19.254.488.254.895 0 .328-.106.63-.317.906-.21.276-.499.565-.863.867-.214.182-.39.374-.531.574-.141.2-.253.42-.336.657a3.656 3.656 0 0 0-.176.777 7.89 7.89 0 0 0-.05.937zm-.321 2.375c0 .188.035.362.105.524.07.161.17.3.301.418.13.117.284.21.46.277.178.068.376.102.595.102.218 0 .416-.034.593-.102.178-.068.331-.16.461-.277a1.2 1.2 0 0 0 .301-.418c.07-.162.106-.336.106-.524a1.3 1.3 0 0 0-.106-.523 1.2 1.2 0 0 0-.3-.418 1.461 1.461 0 0 0-.462-.277 1.651 1.651 0 0 0-.593-.102c-.22 0-.417.034-.594.102a1.46 1.46 0 0 0-.461.277 1.2 1.2 0 0 0-.3.418 1.284 1.284 0 0 0-.106.523z"/></symbol><symbol viewBox="0 0 16 16" id="question-o" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-.778-4.151c0-.301.014-.575.044-.82a3.2 3.2 0 0 1 .154-.68c.073-.208.17-.4.294-.575.123-.176.278-.343.465-.503a4.81 4.81 0 0 0 .755-.758c.185-.242.277-.506.277-.793 0-.356-.074-.617-.222-.783-.148-.166-.37-.25-.667-.25a.92.92 0 0 0-.342.065.806.806 0 0 0-.29.199 1.04 1.04 0 0 0-.209.345 1.5 1.5 0 0 0-.088.506H5.082c.005-.51.092-.948.263-1.313.171-.364.401-.664.69-.899.29-.234.63-.406 1.023-.516a4.66 4.66 0 0 1 1.264-.164c.497 0 .944.058 1.34.174.397.117.733.289 1.008.517.276.227.487.51.633.847.146.337.218.727.218 1.17 0 .295-.042.56-.126.792a2.52 2.52 0 0 1-.349.65 4.4 4.4 0 0 1-.523.584c-.2.19-.414.389-.642.598a2.73 2.73 0 0 0-.332.349c-.089.114-.16.233-.212.359a1.868 1.868 0 0 0-.116.41 3.39 3.39 0 0 0-.044.489H7.222zm-.28 2.078c0-.164.03-.317.092-.458a1.05 1.05 0 0 1 .263-.366c.114-.103.248-.183.403-.243a1.45 1.45 0 0 1 .52-.089c.191 0 .364.03.52.09.154.059.289.14.403.242.114.103.201.224.263.366.061.141.092.294.092.458 0 .164-.03.316-.092.458a1.05 1.05 0 0 1-.263.365 1.278 1.278 0 0 1-.404.243 1.43 1.43 0 0 1-.52.089c-.19 0-.364-.03-.519-.089-.155-.06-.29-.14-.403-.243a1.05 1.05 0 0 1-.263-.365 1.135 1.135 0 0 1-.093-.458z"/></symbol><symbol viewBox="0 0 16 16" id="quote" xmlns="http://www.w3.org/2000/svg"><path d="M15 3v8a3 3 0 0 1-3 3 1 1 0 0 1 0-2 1 1 0 0 0 1-1V9h-2a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h3a1 1 0 0 1 1 1zM7 3v8a3 3 0 0 1-3 3 1 1 0 0 1 0-2 1 1 0 0 0 1-1V9H3a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h3a1 1 0 0 1 1 1z"/></symbol><symbol viewBox="0 0 16 16" id="redo" xmlns="http://www.w3.org/2000/svg"><path d="M4.666 4.423a5 5 0 1 1-.203 6.944 1 1 0 1 0-1.478 1.347 7 7 0 1 0 .12-9.556L1.842 2.137a.5.5 0 0 0-.815.385L1 7.26a.5.5 0 0 0 .607.492l4.629-1.013a.5.5 0 0 0 .207-.877L4.666 4.423z"/></symbol><symbol viewBox="0 0 16 16" id="remove" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 3a1 1 0 1 1 0-2h12a1 1 0 0 1 0 2v10a3 3 0 0 1-3 3H5a3 3 0 0 1-3-3V3zm3-2a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1H5zM4 3v10a1 1 0 0 0 1 1h6a1 1 0 0 0 1-1V3H4zm2.5 2a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5zm3 0a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5z"/></symbol><symbol viewBox="0 0 16 16" id="repeat" xmlns="http://www.w3.org/2000/svg"><path d="M11.494 4.423a5 5 0 1 0 .203 6.944 1 1 0 1 1 1.478 1.347 7 7 0 1 1-.12-9.556l1.262-1.021a.5.5 0 0 1 .815.385l.028 4.738a.5.5 0 0 1-.607.492L9.924 6.739a.5.5 0 0 1-.207-.877l1.777-1.439z"/></symbol><symbol viewBox="0 0 16 16" id="retry" xmlns="http://www.w3.org/2000/svg"><path d="M4.009 6.958a4 4 0 0 0 5.283 4.775 1 1 0 0 1 .712 1.87A6 6 0 0 1 2.077 6.44l-.741-.2a.5.5 0 0 1-.12-.915L3.41 4.058a.5.5 0 0 1 .683.183l1.268 2.196a.5.5 0 0 1-.563.733l-.79-.212zm7.777 2.084a4 4 0 0 0-5.284-4.775 1 1 0 0 1-.711-1.87 6 6 0 0 1 7.927 7.162l.74.2a.5.5 0 0 1 .121.915l-2.196 1.268a.5.5 0 0 1-.683-.183l-1.267-2.196a.5.5 0 0 1 .562-.733l.79.212z"/></symbol><symbol viewBox="0 0 16 16" id="scale" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.99 9a.792.792 0 0 0-.078-.231L13 7l-.912 1.769a.791.791 0 0 0-.077.231h1.978zm-10 0a.792.792 0 0 0-.078-.231L3 7l-.912 1.769A.791.791 0 0 0 2.011 9h1.978zM2 0h12a1 1 0 0 1 0 2H2a1 1 0 1 1 0-2zm3 14h6a1 1 0 0 1 0 2H5a1 1 0 0 1 0-2zM8 4a1 1 0 0 1 1 1v9H7V5a1 1 0 0 1 1-1zm-4.53-.714l2.265 4.735c.68 1.42.006 3.091-1.504 3.73A3.161 3.161 0 0 1 3 12c-1.657 0-3-1.263-3-2.821 0-.4.09-.794.264-1.158L2.53 3.286a.53.53 0 0 1 .94 0zm10 0l2.265 4.735c.68 1.42.006 3.091-1.504 3.73A3.161 3.161 0 0 1 13 12c-1.657 0-3-1.263-3-2.821 0-.4.09-.794.264-1.158l2.266-4.735a.53.53 0 0 1 .94 0z"/></symbol><symbol viewBox="0 0 16 16" id="screen-full" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M14 14v-2a1 1 0 0 1 2 0v3a.997.997 0 0 1-1 1h-3a1 1 0 0 1 0-2h2zM2 14v-2a1 1 0 0 0-2 0v3a1 1 0 0 0 1 1h3a1 1 0 0 0 0-2H2zM15.707.293A.997.997 0 0 1 16 1v3a1 1 0 0 1-2 0V2h-2a1 1 0 0 1 0-2h3c.276 0 .526.112.707.293zM2 2v2a1 1 0 1 1-2 0V1a.997.997 0 0 1 1-1h3a1 1 0 1 1 0 2H2zm4 4h4a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="screen-normal" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3 3V1a1 1 0 1 1 2 0v3a.997.997 0 0 1-1 1H1a1 1 0 1 1 0-2h2zm10 0h2a1 1 0 0 1 0 2h-3a.997.997 0 0 1-1-1V1a1 1 0 0 1 2 0v2zM3 13H1a1 1 0 0 1 0-2h3a.997.997 0 0 1 1 1v3a1 1 0 0 1-2 0v-2zm10 0v2a1 1 0 0 1-2 0v-3a.997.997 0 0 1 1-1h3a1 1 0 0 1 0 2h-2zM6.5 7h3a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5z"/></symbol><symbol viewBox="0 0 16 16" id="search" xmlns="http://www.w3.org/2000/svg"><path d="M8.853 8.854a3.5 3.5 0 1 0-4.95-4.95 3.5 3.5 0 0 0 4.95 4.95zm.207 2.328a5.5 5.5 0 1 1 2.121-2.121l3.329 3.328a1.5 1.5 0 0 1-2.121 2.121L9.06 11.182z"/></symbol><symbol viewBox="0 0 16 16" id="settings" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2.415 5.803L1.317 4.084A.5.5 0 0 1 1.35 3.5l.805-.994a.5.5 0 0 1 .564-.153l1.878.704a5.975 5.975 0 0 1 1.65-.797L6.885.342A.5.5 0 0 1 7.36 0h1.28a.5.5 0 0 1 .474.342l.639 1.918a5.97 5.97 0 0 1 1.65.797l1.877-.704a.5.5 0 0 1 .565.153l.805.994a.5.5 0 0 1 .032.584l-1.097 1.719c.217.551.354 1.143.399 1.76l1.731 1.058a.5.5 0 0 1 .227.54l-.288 1.246a.5.5 0 0 1-.44.385l-2.008.19a6.026 6.026 0 0 1-1.142 1.431l.265 1.995a.5.5 0 0 1-.277.516l-1.15.56a.5.5 0 0 1-.576-.1l-1.424-1.452a6.047 6.047 0 0 1-1.804 0l-1.425 1.453a.5.5 0 0 1-.576.1l-1.15-.561a.5.5 0 0 1-.276-.516l.265-1.995a6.026 6.026 0 0 1-1.143-1.43l-2.008-.191a.5.5 0 0 1-.44-.385L.058 9.16a.5.5 0 0 1 .226-.539l1.732-1.058a5.968 5.968 0 0 1 .399-1.76zM8 11a3 3 0 1 0 0-6 3 3 0 0 0 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="shield" xmlns="http://www.w3.org/2000/svg"><path d="M4 0h8a3 3 0 0 1 3 3v7.186a3 3 0 0 1-1.426 2.554l-4 2.465a3 3 0 0 1-3.148 0l-4-2.465A3 3 0 0 1 1 10.186V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v7.186a1 1 0 0 0 .475.852l4 2.464a1 1 0 0 0 1.05 0l4-2.464a1 1 0 0 0 .475-.852V3a1 1 0 0 0-1-1H4zm0 1.5a.5.5 0 0 1 .5-.5h4v8.837a.5.5 0 0 1-.753.431l-3.5-2.052A.5.5 0 0 1 4 9.785V3.5z"/></symbol><symbol viewBox="0 0 16 16" id="slight-frown" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-2.163-3.275a2.499 2.499 0 0 1 4.343.03.5.5 0 0 1-.871.49 1.5 1.5 0 0 0-2.607-.018.5.5 0 1 1-.865-.502zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="slight-smile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm-5.163 2.254a.5.5 0 1 1 .865-.502 1.499 1.499 0 0 0 2.607-.018.5.5 0 1 1 .871.49 2.499 2.499 0 0 1-4.343.03z"/></symbol><symbol viewBox="0 0 16 16" id="smile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM6.18 6.27a.5.5 0 0 1-.873.487.5.5 0 0 0-.872-.003.5.5 0 1 1-.87-.495 1.5 1.5 0 0 1 2.616.012zm6 0a.5.5 0 1 1-.873.487.5.5 0 0 0-.872-.003.5.5 0 1 1-.87-.495 1.5 1.5 0 0 1 2.616.012zM5 9a3 3 0 0 0 6 0H5z"/></symbol><symbol viewBox="0 0 16 16" id="smiley" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zM5 9h6a3 3 0 0 1-6 0z"/></symbol><symbol viewBox="0 0 16 16" id="snippet" xmlns="http://www.w3.org/2000/svg"><path d="M10.67 9.31a3.001 3.001 0 0 1 2.062 5.546 3 3 0 0 1-3.771-4.559 1.007 1.007 0 0 1-.095-.137l-4.5-7.794a1 1 0 0 1 1.732-1l4.5 7.794c.028.05.052.1.071.15zm-3.283.35l-.289.5c-.028.05-.06.095-.095.137a3.001 3.001 0 0 1-3.77 4.56A3 3 0 0 1 5.294 9.31c.02-.051.043-.102.071-.15l.866-1.5 1.155 2zm2.31-4l-1.156-2 1.325-2.294a1 1 0 0 1 1.732 1L9.696 5.66zm-5.465 7.464a1 1 0 1 0 1-1.732 1 1 0 0 0-1 1.732zm7.5 0a1 1 0 1 0-1-1.732 1 1 0 0 0 1 1.732z"/></symbol><symbol viewBox="0 0 16 16" id="spam" xmlns="http://www.w3.org/2000/svg"><path d="M8.75.433l5.428 3.134a1.5 1.5 0 0 1 .75 1.299v6.268a1.5 1.5 0 0 1-.75 1.299L8.75 15.567a1.5 1.5 0 0 1-1.5 0l-5.428-3.134a1.5 1.5 0 0 1-.75-1.299V4.866a1.5 1.5 0 0 1 .75-1.299L7.25.433a1.5 1.5 0 0 1 1.5 0zM3.072 5.155v5.69L8 13.691l4.928-2.846v-5.69L8 2.309 3.072 5.155zM8 4a1 1 0 0 1 1 1v3a1 1 0 1 1-2 0V5a1 1 0 0 1 1-1zm0 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="star" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.609 14.394l-3.465 1.473a1 1 0 0 1-1.39-.989l.276-4.024a1 1 0 0 0-.219-.694L.303 7.037A1 1 0 0 1 .83 5.443l3.715-.964a1 1 0 0 0 .609-.457L7.14.682a1 1 0 0 1 1.72 0l1.985 3.34a1 1 0 0 0 .609.457l3.715.964a1 1 0 0 1 .528 1.594L13.19 10.16a1 1 0 0 0-.219.694l.275 4.024a1 1 0 0 1-1.389.989l-3.465-1.473a1 1 0 0 0-.782 0z"/></symbol><symbol viewBox="0 0 16 16" id="star-o" xmlns="http://www.w3.org/2000/svg"><path d="M10.975 10.99a3 3 0 0 1 .655-2.083l1.54-1.916-2.219-.576a3 3 0 0 1-1.825-1.37L8 3.15 6.874 5.044a3 3 0 0 1-1.825 1.371l-2.218.576 1.54 1.916a3 3 0 0 1 .654 2.083l-.165 2.4 1.965-.836a3 3 0 0 1 2.348 0l1.965.836-.164-2.399zM7.61 14.394l-3.465 1.473a1 1 0 0 1-1.39-.989l.276-4.024a1 1 0 0 0-.219-.694L.303 7.037A1 1 0 0 1 .83 5.443l3.715-.964a1 1 0 0 0 .609-.457L7.14.682a1 1 0 0 1 1.72 0l1.985 3.34a1 1 0 0 0 .609.457l3.715.964a1 1 0 0 1 .528 1.594L13.19 10.16a1 1 0 0 0-.219.694l.275 4.024a1 1 0 0 1-1.389.989l-3.465-1.473a1 1 0 0 0-.782 0z"/></symbol><symbol viewBox="0 0 16 16" id="stop" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 0h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2z"/></symbol><symbol viewBox="0 0 16 16" id="talic" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 0h7a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm2 2h3L8 14H5L8 2zM3 14h7a1 1 0 0 1 0 2H3a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="task-done" xmlns="http://www.w3.org/2000/svg"><path d="M7.536 8.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 0 1 6.12 7.243l1.415 1.414zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="template" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3zm.8 2h2.4a.8.8 0 0 1 .8.8v1.4a.8.8 0 0 1-.8.8H3.8a.8.8 0 0 1-.8-.8V4.8a.8.8 0 0 1 .8-.8zm4.7 0h4a.5.5 0 1 1 0 1h-4a.5.5 0 0 1 0-1zm0 2h4a.5.5 0 1 1 0 1h-4a.5.5 0 0 1 0-1zm-5 3h9a.5.5 0 1 1 0 1h-9a.5.5 0 0 1 0-1zm0 2h9a.5.5 0 1 1 0 1h-9a.5.5 0 1 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="thump-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.33 11h5.282a2 2 0 0 0 1.963-2.38l-.563-2.905a3 3 0 0 0-.243-.732l-1.103-2.286A3 3 0 0 0 10.964 1H7a3 3 0 0 0-3 3v6.3a2 2 0 0 0 .436 1.247l3.11 3.9a.632.632 0 0 0 .941.053l.137-.137a1 1 0 0 0 .28-.87L8.329 11zM1 10h2V3H1a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1z"/></symbol><symbol viewBox="0 0 16 16" id="thump-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.33 5h5.282a2 2 0 0 1 1.963 2.38l-.563 2.905a3 3 0 0 1-.243.732l-1.103 2.286A3 3 0 0 1 10.964 15H7a3 3 0 0 1-3-3V5.7a2 2 0 0 1 .436-1.247l3.11-3.9A.632.632 0 0 1 8.487.5l.137.137a1 1 0 0 1 .28.87L8.329 5zM1 6h2v7H1a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="timer" xmlns="http://www.w3.org/2000/svg"><path d="M12.022 3.27l.77-.77a1 1 0 0 1 1.415 1.414l-.728.729a7 7 0 1 1-1.456-1.372zM8 14A5 5 0 1 0 8 4a5 5 0 0 0 0 10zm0-9a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0V6a1 1 0 0 1 1-1zM6 0h4a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="todo-add" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 4V2a1 1 0 0 1 2 0v2h2a1 1 0 0 1 0 2h-2v2a1 1 0 0 1-2 0V6H8a1 1 0 1 1 0-2h2zm2 7a1 1 0 0 1 2 0v2a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h2a1 1 0 1 1 0 2H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-2z"/></symbol><symbol viewBox="0 0 16 16" id="todo-done" xmlns="http://www.w3.org/2000/svg"><path d="M8.243 7.485l4.95-4.95a1 1 0 1 1 1.414 1.415L8.95 9.607a.997.997 0 0 1-1.414 0L4.707 6.778a1 1 0 0 1 1.414-1.414l2.122 2.121zM12 11a1 1 0 0 1 2 0v2a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h2a1 1 0 1 1 0 2H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-2z"/></symbol><symbol viewBox="0 0 16 16" id="token" xmlns="http://www.w3.org/2000/svg"><path d="M3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v6a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H3zm1 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="unapproval" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M11.95 8.536l1.06-1.061a1 1 0 0 1 1.415 1.414l-1.061 1.06 1.06 1.061a1 1 0 0 1-1.414 1.415l-1.06-1.061-1.06 1.06a1 1 0 1 1-1.415-1.414l1.06-1.06-1.06-1.06a1 1 0 0 1 1.414-1.415l1.06 1.06zm-3.768-.33c.006.503.201 1.006.586 1.39l.353.354-.353.353a2 2 0 1 0 2.828 2.829l.354-.354.047.048C11.964 14.363 11.527 15 6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8c.834 0 1.557.074 2.182.205zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="unassignee" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M11 5h4a1 1 0 0 1 0 2h-4a1 1 0 0 1 0-2zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="unlink" xmlns="http://www.w3.org/2000/svg"><path d="M11.295 8.845l-.659-1.664a1.78 1.78 0 0 0 .04-.04l1.415-1.414c.586-.586.654-1.468.152-1.97s-1.384-.434-1.97.152L8.859 5.323a1.781 1.781 0 0 0-.04.04l-1.664-.658c.141-.208.305-.408.491-.594l1.415-1.414c1.366-1.367 3.424-1.525 4.596-.354 1.171 1.172 1.013 3.23-.354 4.596L11.89 8.354c-.186.186-.386.35-.594.491zm-2.45 2.45a4.075 4.075 0 0 1-.491.594l-1.415 1.414c-1.366 1.367-3.424 1.525-4.596.354-1.171-1.172-1.013-3.23.354-4.596L4.11 7.646c.186-.186.386-.35.594-.491l.659 1.664a1.781 1.781 0 0 0-.04.04l-1.415 1.414c-.586.586-.654 1.468-.152 1.97s1.384.434 1.97-.152l1.414-1.414a1.78 1.78 0 0 0 .04-.04l1.664.658zm3.812-2.088h2a.5.5 0 0 1 .5.5v.05a.5.5 0 0 1-.5.5h-2a.5.5 0 0 1-.5-.5v-.05a.5.5 0 0 1 .5-.5zm-.384 2.116l1.415 1.414a.5.5 0 0 1 0 .708l-.037.036a.5.5 0 0 1-.707 0l-1.414-1.414a.5.5 0 0 1 0-.707l.036-.037a.5.5 0 0 1 .707 0zm-2.823 1.09a.5.5 0 0 1 .5-.5h.052a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5H9.95a.5.5 0 0 1-.5-.5v-2zm-2.748-9.16a.5.5 0 0 1-.5.5h-.05a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5h.05a.5.5 0 0 1 .5.5v2zm-2.116.383a.5.5 0 0 1 0 .707l-.036.036a.5.5 0 0 1-.707 0L2.428 2.965a.5.5 0 0 1 0-.707l.037-.036a.5.5 0 0 1 .707 0l1.414 1.414zm-1.09 2.823h-2a.5.5 0 0 1-.5-.5v-.051a.5.5 0 0 1 .5-.5h2a.5.5 0 0 1 .5.5v.05a.5.5 0 0 1-.5.5z"/></symbol><symbol viewBox="0 0 16 16" id="user" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zm0 8c-6.888 0-6.976-.78-6.976-2.52S2.144 8 8 8s6.976 2.692 6.976 4.48c0 1.788-.088 2.52-6.976 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="users" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.521 8.01C15.103 8.19 16 10.755 16 12.48c0 1.533-.056 2.29-3.808 2.475.609-.54.808-1.331.808-2.475 0-1.911-.804-3.503-2.479-4.47zm-1.67-1.228A3.987 3.987 0 0 0 9.976 4a3.987 3.987 0 0 0-1.125-2.782 3 3 0 1 1 0 5.563zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="volume-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 5h1v6H1a1 1 0 0 1-1-1V6a1 1 0 0 1 1-1zm2 0l4.445-2.964A1 1 0 0 1 9 2.87v10.26a1 1 0 0 1-1.555.833L3 11V5zm10.283 7.89a.5.5 0 0 1-.66-.752A5.485 5.485 0 0 0 14.5 8c0-1.601-.687-3.09-1.865-4.128a.5.5 0 0 1 .661-.75A6.484 6.484 0 0 1 15.5 8a6.485 6.485 0 0 1-2.217 4.89zm-2.002-2.236a.5.5 0 1 1-.652-.758c.55-.472.871-1.157.871-1.896 0-.732-.315-1.411-.856-1.883a.5.5 0 0 1 .658-.753A3.492 3.492 0 0 1 12.5 8c0 1.033-.45 1.994-1.219 2.654z"/></symbol><symbol viewBox="0 0 16 16" id="warning" xmlns="http://www.w3.org/2000/svg"><path d="M15.34 10.479A3 3 0 0 1 12.756 15h-9.51A3 3 0 0 1 .66 10.479l4.755-8.083a3 3 0 0 1 5.172 0l4.755 8.083zm-6.478-7.07a1 1 0 0 0-1.724 0l-4.755 8.084A1 1 0 0 0 3.245 13h9.51a1 1 0 0 0 .862-1.507L8.862 3.41zM8 5a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0V6a1 1 0 0 1 1-1zm0 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="work" xmlns="http://www.w3.org/2000/svg"><path d="M12 3h1a3 3 0 0 1 3 3v7a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h1V2a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v1zM6 2v1h4V2H6zM3 5a1 1 0 0 0-1 1v7a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6a1 1 0 0 0-1-1H3zm1.5 1a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5zm7 0a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5z"/></symbol></svg>
\ No newline at end of file
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><symbol viewBox="0 0 16 16" id="abuse" xmlns="http://www.w3.org/2000/svg"><path d="M11.408.328l4.029 3.222A1.5 1.5 0 0 1 16 4.72v6.555a1.5 1.5 0 0 1-.563 1.171l-4.026 3.224a1.5 1.5 0 0 1-.937.329H5.529a1.5 1.5 0 0 1-.937-.328L.563 12.45A1.5 1.5 0 0 1 0 11.28V4.724a1.5 1.5 0 0 1 .563-1.171L4.589.329A1.5 1.5 0 0 1 5.526 0h4.945c.34 0 .67.116.937.328zM10.296 2H5.702L2 4.964v6.074L5.704 14h4.594L14 11.036V4.962L10.296 2zM8 4a1 1 0 0 1 1 1v3a1 1 0 1 1-2 0V5a1 1 0 0 1 1-1zm0 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="account" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9.195 9.965l-.568-.875a.25.25 0 0 1 .015-.294l.405-.5a.25.25 0 0 1 .283-.075l.938.36c.257-.183.543-.325.851-.42l.322-.988A.25.25 0 0 1 11.679 7h.642a.25.25 0 0 1 .238.173l.322.988c.308.095.594.237.851.42l.938-.36a.25.25 0 0 1 .283.076l.405.5a.25.25 0 0 1 .015.293l-.568.875c.113.297.18.616.193.95l.898.54a.25.25 0 0 1 .115.27l-.144.626a.25.25 0 0 1-.222.193l-1.115.098a3.015 3.015 0 0 1-.512.608l.165 1.18a.25.25 0 0 1-.138.259l-.577.281a.25.25 0 0 1-.29-.05l-.874-.905a3.035 3.035 0 0 1-.608 0l-.875.904a.25.25 0 0 1-.289.051l-.577-.281a.25.25 0 0 1-.138-.26l.165-1.18a3.015 3.015 0 0 1-.512-.607l-1.115-.098a.25.25 0 0 1-.222-.193l-.144-.626a.25.25 0 0 1 .115-.27l.898-.54c.013-.334.08-.653.193-.95zM6.789 8.023A12.845 12.845 0 0 0 6 8c-5.036 0-6 2.74-6 4.48C0 14.22.076 15 6 15c.553 0 1.055-.006 1.51-.02A5.977 5.977 0 0 1 6 11c0-1.083.287-2.1.79-2.977zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM12 12a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="admin" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.162 2.5a3.5 3.5 0 0 1-3.163 5.479L6.08 14.766a1.5 1.5 0 0 1-2.598-1.5L7.4 6.479A3.5 3.5 0 0 1 10.564 1L8.9 3.88l2.599 1.5 1.663-2.88zm-8.63 11.949a.5.5 0 1 0 .5-.866.5.5 0 0 0-.5.866z"/></symbol><symbol viewBox="0 0 16 16" id="angle-double-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.414 7.95l4.243-4.243a1 1 0 0 0-1.414-1.414l-4.95 4.95a.997.997 0 0 0 0 1.414l4.95 4.95a1 1 0 1 0 1.414-1.415L10.414 7.95zm-7 0l4.243-4.243a1 1 0 0 0-1.414-1.414l-4.95 4.95a.997.997 0 0 0 0 1.414l4.95 4.95a1 1 0 0 0 1.414-1.415L3.414 7.95z"/></symbol><symbol viewBox="0 0 16 16" id="angle-double-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.536 7.95L1.293 3.707a1 1 0 0 1 1.414-1.414l4.95 4.95a.997.997 0 0 1 0 1.414l-4.95 4.95a1 1 0 1 1-1.414-1.415L5.536 7.95zm7 0L8.293 3.707a1 1 0 0 1 1.414-1.414l4.95 4.95a.997.997 0 0 1 0 1.414l-4.95 4.95a1 1 0 0 1-1.414-1.415l4.243-4.242z"/></symbol><symbol viewBox="0 0 16 16" id="angle-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 10.243l-4.95-4.95a1 1 0 0 0-1.414 1.414l5.657 5.657a.997.997 0 0 0 1.414 0l5.657-5.657a1 1 0 0 0-1.414-1.414L8 10.243z"/></symbol><symbol viewBox="0 0 16 16" id="angle-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.757 8l4.95-4.95a1 1 0 1 0-1.414-1.414L3.636 7.293a.997.997 0 0 0 0 1.414l5.657 5.657a1 1 0 0 0 1.414-1.414L5.757 8z"/></symbol><symbol viewBox="0 0 16 16" id="angle-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.243 8l-4.95-4.95a1 1 0 0 1 1.414-1.414l5.657 5.657a.997.997 0 0 1 0 1.414l-5.657 5.657a1 1 0 0 1-1.414-1.414L10.243 8z"/></symbol><symbol viewBox="0 0 16 16" id="angle-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 6.757l-4.95 4.95a1 1 0 1 1-1.414-1.414l5.657-5.657a.997.997 0 0 1 1.414 0l5.657 5.657a1 1 0 0 1-1.414 1.414L8 6.757z"/></symbol><symbol viewBox="0 0 16 16" id="appearance" xmlns="http://www.w3.org/2000/svg"><path d="M11.161 12.456l.232.121c.1.053.175.094.249.137.53.318.844.75.857 1.402.012 1.397-1.116 1.756-3.12 1.858a23.85 23.85 0 0 1-1.38.026A8 8 0 0 1 0 8a8 8 0 0 1 8-8c4.417 0 7.998 3.582 7.998 7.977.06 2.621-1.312 3.586-4.48 3.648-.602.008-1.068.043-1.4.104.228.192.598.47 1.043.727zm-3.287-.943c-.019-1.495 1.228-1.856 3.611-1.888C13.67 9.582 14.028 9.33 13.998 8A6 6 0 1 0 8 14c.603 0 .91-.004 1.277-.023a9.7 9.7 0 0 0 .478-.035c-1.172-.738-1.868-1.47-1.88-2.43zM6 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm-2-3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zM4 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="applications" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 0h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm6-6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 1v2h2V1H7zm0 5h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm6-6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1V1a1 1 0 0 1 1-1zm0 6h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1zm0 1v2h2V7h-2zM1 12h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1zm0 1v2h2v-2H1zm6-1h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H7a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1zm6 0h2a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1h-2a1 1 0 0 1-1-1v-2a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="approval" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.536 10.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 1 1 9.12 9.243l1.415 1.414zM7.632 8.109A2 2 0 0 0 7 11.364l2.121 2.121a1.996 1.996 0 0 0 2.807.021C11.686 14.554 10.627 15 6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8c.6 0 1.142.038 1.632.109zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="arrow-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 6H2a2 2 0 1 0 0 4h7v2.586a1 1 0 0 0 1.707.707l4.586-4.586a1 1 0 0 0 0-1.414l-4.586-4.586A1 1 0 0 0 9 3.414V6z"/></symbol><symbol viewBox="0 0 16 16" id="assignee" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12 5V4a1 1 0 0 1 2 0v1h1a1 1 0 0 1 0 2h-1v1a1 1 0 0 1-2 0V7h-1a1 1 0 0 1 0-2h1zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="bold" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 15V1a1 1 0 0 1 1-1h4.604c.93 0 1.762.088 2.495.264.733.176 1.353.445 1.863.807.509.363.897.82 1.164 1.369.268.549.401 1.197.401 1.945 0 .366-.045.718-.137 1.055-.091.337-.23.652-.417.945a3.453 3.453 0 0 1-.71.796 3.645 3.645 0 0 1-1.021.588c.469.117.87.295 1.203.533.333.238.608.515.824.83.216.315.374.657.473 1.027.099.37.148.75.148 1.138 0 1.553-.5 2.725-1.5 3.516-1 .791-2.423 1.187-4.27 1.187H3a1 1 0 0 1-1-1zm3.297-5.967v4.319H8.12c.425 0 .791-.053 1.099-.16.307-.106.564-.252.769-.44.205-.186.357-.406.456-.659.099-.252.148-.529.148-.83a3.04 3.04 0 0 0-.131-.928 1.78 1.78 0 0 0-.413-.703 1.8 1.8 0 0 0-.73-.445c-.3-.103-.66-.154-1.077-.154H5.297zm0-2.33h2.44c.842-.014 1.468-.192 1.878-.533.41-.34.616-.826.616-1.456 0-.725-.21-1.247-.632-1.566-.421-.318-1.086-.478-1.995-.478H5.297v4.033z"/></symbol><symbol viewBox="0 0 16 16" id="book" xmlns="http://www.w3.org/2000/svg"><path d="M7 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2v4.191a.5.5 0 0 1-.724.447l-1.052-.526a.5.5 0 0 0-.448 0l-1.052.526A.5.5 0 0 1 7 6.191V2zM5 0h6a4 4 0 0 1 4 4v8a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4z"/></symbol><symbol viewBox="0 0 16 16" id="branch" xmlns="http://www.w3.org/2000/svg"><path d="M6 11.978v.29a2 2 0 1 1-2 0V3.732a2 2 0 1 1 2 0v3.849c.592-.491 1.31-.854 2.15-1.081 1.308-.353 1.875-.882 1.893-1.743a2 2 0 1 1 2.002-.051C12.053 6.54 10.857 7.84 8.67 8.43 7.056 8.867 6.195 9.98 6 11.978zM5 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm6 1a1 1 0 1 0 0-2 1 1 0 0 0 0 2zM5 15a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="calendar" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12 2h2a2 2 0 0 1 2 2H0a2 2 0 0 1 2-2h2V1a1 1 0 1 1 2 0v1h4V1a1 1 0 1 1 2 0v1zM0 4h16v9a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V4zm2 2.5V13a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6.5a.5.5 0 0 0-.5-.5h-11a.5.5 0 0 0-.5.5zM5 8h2a1 1 0 1 1 0 2H5a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="cancel" xmlns="http://www.w3.org/2000/svg"><path d="M3.11 4.523a6 6 0 0 0 8.367 8.367L3.109 4.524zM4.522 3.11l8.368 8.368A6 6 0 0 0 4.524 3.11zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.078 8.2l3.535-3.536a2 2 0 0 1 2.828 2.828l-4.949 4.95c-.39.39-.902.586-1.414.586a1.994 1.994 0 0 1-1.414-.586l-4.95-4.95a2 2 0 1 1 2.828-2.828l3.536 3.535z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-left" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.977 7.998l3.535-3.535a2 2 0 1 0-2.828-2.828l-4.95 4.949c-.39.39-.586.902-.586 1.414 0 .512.196 1.024.586 1.414l4.95 4.95a2 2 0 1 0 2.828-2.828L7.977 7.998z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-right" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.22 7.998L4.683 4.463a2 2 0 0 1 2.828-2.828l4.95 4.949c.39.39.586.902.586 1.414a1.99 1.99 0 0 1-.586 1.414l-4.95 4.95a2 2 0 0 1-2.828-2.828l3.535-3.536z"/></symbol><symbol viewBox="0 0 16 16" id="chevron-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.778 8.957l3.535 3.535a2 2 0 1 0 2.828-2.828l-4.949-4.95a1.994 1.994 0 0 0-1.414-.586c-.512 0-1.024.196-1.414.586l-4.95 4.95a2 2 0 1 0 2.828 2.828l3.536-3.535z"/></symbol><symbol viewBox="0 0 16 16" id="clock" xmlns="http://www.w3.org/2000/svg"><path d="M9 7h1a1 1 0 0 1 0 2H8a.997.997 0 0 1-1-1V5a1 1 0 1 1 2 0v2zm-1 9A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="close" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9.414 8l4.95-4.95a1 1 0 0 0-1.414-1.414L8 6.586l-4.95-4.95A1 1 0 0 0 1.636 3.05L6.586 8l-4.95 4.95a1 1 0 1 0 1.414 1.414L8 9.414l4.95 4.95a1 1 0 1 0 1.414-1.414L9.414 8z"/></symbol><symbol viewBox="0 0 16 16" id="code" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M15.871 8.243a.997.997 0 0 0-.293-.707L12.75 4.707a1 1 0 0 0-1.414 1.414l2.12 2.122-2.12 2.121a1 1 0 0 0 1.414 1.414l2.828-2.828a.997.997 0 0 0 .293-.707zm-13.243 0L4.75 6.12a1 1 0 1 0-1.414-1.414L.507 7.536a.997.997 0 0 0 0 1.414l2.829 2.828a1 1 0 1 0 1.414-1.414L2.628 8.243zm6.407-4.107a1 1 0 0 1 .707 1.225L8.19 11.157a1 1 0 1 1-1.931-.518L7.81 4.843a1 1 0 0 1 1.224-.707z"/></symbol><symbol viewBox="0 0 9 13" id="collapse"><path d="M.084.25C.01.18-.015.12.008.071.031.024.093 0 .194 0h8.521c.1 0 .162.024.185.072.023.048-.002.107-.075.177l-4.11 3.935a.372.372 0 0 1-.11.072h-.301a.508.508 0 0 1-.11-.072L.084.249zM.377 6.88a.364.364 0 0 1-.26-.105.334.334 0 0 1-.11-.25v-.709c0-.096.036-.179.11-.249a.364.364 0 0 1 .26-.105h8.15c.101 0 .188.035.261.105.074.07.11.153.11.25v.709c0 .096-.036.179-.11.249a.364.364 0 0 1-.26.105H.377zM.084 12.132c-.074.07-.099.129-.076.177.023.048.085.072.186.072h8.521c.1 0 .162-.024.185-.072.023-.048-.002-.107-.075-.177l-4.11-3.935a.372.372 0 0 0-.11-.072h-.301a.508.508 0 0 0-.11.072l-4.11 3.935z"/></symbol><symbol viewBox="0 0 16 16" id="comment" xmlns="http://www.w3.org/2000/svg"><path d="M1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586z"/></symbol><symbol viewBox="0 0 16 16" id="comment-dots" xmlns="http://www.w3.org/2000/svg"><path d="M1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586zM5 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="comment-next" xmlns="http://www.w3.org/2000/svg"><path d="M8 5V4a.5.5 0 0 1 .8-.4l2.667 2a.5.5 0 0 1 0 .8L8.8 8.4A.5.5 0 0 1 8 8V7H6a1 1 0 1 1 0-2h2zM1.707 15.707C1.077 16.337 0 15.891 0 15V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H5.414l-3.707 3.707zM2 12.586l2.293-2.293A1 1 0 0 1 5 10h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v9.586z"/></symbol><symbol viewBox="0 0 16 16" id="comments" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3.75 10L0 13V3a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2H3.75zM13 5h1a2 2 0 0 1 2 2v8l-2.667-2H8a2 2 0 0 1-2-2h4a3 3 0 0 0 3-3V5z"/></symbol><symbol viewBox="0 0 16 16" id="commit" xmlns="http://www.w3.org/2000/svg"><path d="M8 10a2 2 0 1 0 0-4 2 2 0 0 0 0 4zm3.876-1.008a4.002 4.002 0 0 1-7.752 0A1.01 1.01 0 0 1 4 9H1a1 1 0 1 1 0-2h3c.042 0 .083.003.124.008a4.002 4.002 0 0 1 7.752 0A1.01 1.01 0 0 1 12 7h3a1 1 0 0 1 0 2h-3a1.01 1.01 0 0 1-.124-.008z"/></symbol><symbol viewBox="0 0 16 16" id="credit-card" xmlns="http://www.w3.org/2000/svg"><path d="M14 5a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1h12zm0 3H2v3a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V8zM3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm6.5 8h3a.5.5 0 1 1 0 1h-3a.5.5 0 1 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="dashboard" xmlns="http://www.w3.org/2000/svg"><path d="M7.709 10.021l.696-2.6a.5.5 0 0 1 .966.26l-.657 2.45A2 2 0 0 1 10 12H6a2 2 0 0 1 1.709-1.979zM0 8.9a8 8 0 0 1 15.998 0H16v3.6a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5V8.9zM14 9A6 6 0 1 0 2 9v3.5a.5.5 0 0 0 .5.5h11a.5.5 0 0 0 .5-.5V9zM3.5 9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm9 0a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-7-3a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm5 0a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1z"/></symbol><symbol viewBox="0 0 16 16" id="disk" xmlns="http://www.w3.org/2000/svg"><path d="M16 11.764V3a3 3 0 0 0-3-3H3a3 3 0 0 0-3 3v8.764A2.989 2.989 0 0 1 2 11V3a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v8c.768 0 1.47.289 2 .764zM2 12h12a2 2 0 1 1 0 4H2a2 2 0 1 1 0-4zm10 1a1 1 0 1 0 0 2 1 1 0 0 0 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="doc_code" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zm1.036 7.607a.498.498 0 0 1-.147.354l-1.414 1.414a.5.5 0 0 1-.707-.707l1.06-1.06-1.06-1.061a.5.5 0 0 1 .707-.707l1.414 1.414a.498.498 0 0 1 .147.353zm-4.822 0l1.06 1.061a.5.5 0 0 1-.706.707l-1.414-1.414a.498.498 0 0 1 0-.707l1.414-1.414a.5.5 0 1 1 .707.707l-1.06 1.06zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4z"/></symbol><symbol viewBox="0 0 16 16" id="doc_image" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zM7.333 9.667l1.313-1.313a.5.5 0 0 1 .708 0L12 11H4l2.188-1.75a.5.5 0 0 1 .624 0l.521.417zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4zm.5 8a1.5 1.5 0 1 1 0-3 1.5 1.5 0 0 1 0 3zM4 11h8v.7a.3.3 0 0 1-.3.3H4.3a.3.3 0 0 1-.3-.3V11z"/></symbol><symbol viewBox="0 0 16 16" id="doc_text" xmlns="http://www.w3.org/2000/svg"><path d="M8 2H5a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2V7h-3a2 2 0 0 1-2-2V2zm2 .414V5h2.586L10 2.414zM5 0h4.586A2 2 0 0 1 11 .586L14.414 4A2 2 0 0 1 15 5.414V12a4 4 0 0 1-4 4H5a4 4 0 0 1-4-4V4a4 4 0 0 1 4-4zm.5 11h5a.5.5 0 1 1 0 1h-5a.5.5 0 1 1 0-1zm0-2h5a.5.5 0 1 1 0 1h-5a.5.5 0 0 1 0-1zm0-2h2a.5.5 0 0 1 0 1h-2a.5.5 0 0 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="download" xmlns="http://www.w3.org/2000/svg"><path d="M9 12h1a.5.5 0 0 1 .4.8l-2 2.667a.5.5 0 0 1-.8 0l-2-2.667A.5.5 0 0 1 6 12h1V8a1 1 0 1 1 2 0v4zM4 9a1 1 0 1 1 0 2 4 4 0 0 1-1.971-7.481 4 4 0 0 1 6.633-2.505 3.999 3.999 0 0 1 3.82 2.014A4 4 0 0 1 12 11a1 1 0 0 1 0-2 2 2 0 1 0 0-4h-1a2 2 0 0 0-3.112-1.662A2 2 0 1 0 4.268 5H4a2 2 0 1 0 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="duplicate" xmlns="http://www.w3.org/2000/svg"><path d="M14 10h-3a1 1 0 0 1-1-1V6H8.527A.527.527 0 0 0 8 6.527V13a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1v-3zm-4-7H8.527c-.18 0-.355.013-.527.04V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v6a1 1 0 0 0 1 1h2v2H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h4a3 3 0 0 1 3 3zM8.527 4h2.323a.5.5 0 0 1 .35.143l4.65 4.551a.5.5 0 0 1 .15.357V13a3 3 0 0 1-3 3H9a3 3 0 0 1-3-3V6.527A2.527 2.527 0 0 1 8.527 4z"/></symbol><symbol viewBox="0 0 16 16" id="earth" xmlns="http://www.w3.org/2000/svg"><path d="M8.7 2.04l-.082.177c.283.223.422.413.417.571-.008.237-.311.057-.444.274-.133.218.038.542-.112.637-.15.096-.398-.386-.479-.46-.054-.049-.166-.257-.336-.625l-.216-.225a.844.844 0 0 0-.418-.035c-.177.038-.075.1-.035.132.04.032.32.037.452.2.132.164.03.224-.05.298-.054.05-.157.062-.31.035H5.952l-.402.398.03.325.229.455.324-.463c.008-.206.058-.342.15-.41.14-.1.342-.15.534-.085.191.066-.057.218.011.271.068.053.204-.098.313-.02.11.08.07.155.104.322.036.167.254.114.398.328.144.215.19.29.147.483-.043.195-.168.26-.305.232-.138-.028-.107-.246-.275-.348-.168-.102-.266-.114-.386-.054-.12.06-.016.129.023.235.04.106.274.321.224.43-.05.107-.108.116-.42 0-.21-.077-.414-.007-.615.212l-.76.722c-.153.715-.3 1.13-.44 1.243-.211.17-.177-.483-.483-.656-.306-.174-.494-.047-.8-.07-.307-.023-.42.65-.38.873a.434.434 0 0 0 .221.321c.236-.141.39-.184.465-.128.11.084-.144.267-.074.425.07.158.314.069.386.283.073.213.084.48-.05.706-.135.227-.275.178-.4.053-.127-.126-.033-.375-.255-.704-.223-.329-.381-.337-.63-.787-.158-.287-.35-.743-.575-1.366a6 6 0 0 0 3.21 7.198l.001-.075c0-.577-.004-.944-.012-1.102-.011-.236-.95-.945-1.104-1.2-.154-.256-.34-.595-.355-.746-.016-.151.185-.232.344-.325.16-.093-.11-.367.028-.626.137-.258.395-.438.496-.356.101.081.058.228.267.333.209.104.077-.213.456-.178.38.035.143.201.252.216.11.016.113-.127.299-.143.186-.015.282.445.471.622.19.178.452.008.611.043.159.034.267.09.402.255.136.166-.03.352.073.557.103.205 1.07.22 1.433.255.364.034.371.011.371.324s-.166.314-.453.507c-.286.193-.166.462-.38.762-.212.3-.316.062-.622.14-.306.077-.413.382-.452.568-.039.186-.386.094-.877.232-.29.082-.429.144-.569.204a6.002 6.002 0 0 0 7.682-4.3c-.094-.384-.18-.63-.258-.74-.213-.297-.36.21-.924.49-.564.278-.57-.288-.81-.49-.16-.133-.212-.44-.158-.92-.005-.478.02-.828.077-1.049.057-.221.126-.543.207-.965.351-.373.606-.572.764-.595.237-.034.336.374.658.3a.315.315 0 0 0 .035-.01 5.993 5.993 0 0 0-.475-.824l-.309-.043a.646.646 0 0 0-.332-.117c-.205-.02-.025.128-.089.24-.064.112-.235.724-.437.685-.201-.039-.204-.374-.17-.668.036-.294-.077-.35-.2-.412-.124-.062-.325-.213-.556-.295-.232-.082-.123-.175-.093-.274.03-.1.208-.015.193-.058-.014-.044-.313-.135-.266-.167.03-.02.2-.02.506.003l.216-.012.293-.163a.58.58 0 0 0-.376-.22c-.233-.036-.513-.034-.73-.142-.205-.103-.458-.36-.643-.638A5.965 5.965 0 0 0 8.7 2.04zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16z"/></symbol><symbol viewBox="0 0 16 16" id="eye" xmlns="http://www.w3.org/2000/svg"><path d="M8 14C4.816 14 2.253 12.284.393 8.981a2 2 0 0 1 0-1.962C2.253 3.716 4.816 2 8 2s5.747 1.716 7.607 5.019a2 2 0 0 1 0 1.962C13.747 12.284 11.184 14 8 14zm0-2c2.41 0 4.338-1.29 5.864-4C12.338 5.29 10.411 4 8 4 5.59 4 3.662 5.29 2.136 8 3.662 10.71 5.589 12 8 12zm0-1a3 3 0 1 1 0-6 3 3 0 0 1 0 6zm1-3a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="eye-slash" xmlns="http://www.w3.org/2000/svg"><path d="M13.618 2.62L1.62 14.619a1 1 0 0 1-.985-1.668l1.525-1.526C1.516 10.742.926 9.927.393 8.981a2 2 0 0 1 0-1.962C2.253 3.716 4.816 2 8 2c1.074 0 2.076.195 3.006.58l.944-.944a1 1 0 0 1 1.668.985zM8.068 11a3 3 0 0 0 2.931-2.932l-2.931 2.931zm-3.02-2.462a3 3 0 0 1 3.49-3.49l.884-.884A6.044 6.044 0 0 0 8 4C5.59 4 3.662 5.29 2.136 8c.445.79.924 1.46 1.439 2.011l1.473-1.473zm.421 5.06l1.658-1.658c.283.04.575.06.873.06 2.41 0 4.338-1.29 5.864-4a11.023 11.023 0 0 0-1.133-1.664l1.418-1.418a12.799 12.799 0 0 1 1.458 2.1 2 2 0 0 1 0 1.963C13.747 12.284 11.184 14 8 14a7.883 7.883 0 0 1-2.53-.402z"/></symbol><symbol viewBox="0 0 16 16" id="file-additions" xmlns="http://www.w3.org/2000/svg"><path d="M7 7V5a1 1 0 1 1 2 0v2h2a1 1 0 0 1 0 2H9v2a1 1 0 0 1-2 0V9H5a1 1 0 1 1 0-2h2zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3z"/></symbol><symbol viewBox="0 0 16 16" id="file-deletion" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3zm2 6h6a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="file-modified" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 1a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3a2 2 0 0 0-2-2H3zm5 4a3 3 0 1 1 0 6 3 3 0 0 1 0-6z"/></symbol><symbol viewBox="0 0 16 16" id="filter" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 6v9l-3.724-1.862A.5.5 0 0 1 6 12.691V6L1.854 1.854A.5.5 0 0 1 2.207 1h11.586a.5.5 0 0 1 .353.854L10 6z"/></symbol><symbol viewBox="0 0 16 16" id="folder" xmlns="http://www.w3.org/2000/svg"><path d="M7.228 5l-.475-1.335A1 1 0 0 0 5.81 3H2v9a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6a1 1 0 0 0-1-1H7.228zM13 3a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a2 2 0 0 1 2-2h3.81a3 3 0 0 1 2.827 1.995L13 3z"/></symbol><symbol viewBox="0 0 16 16" id="fork" xmlns="http://www.w3.org/2000/svg"><path d="M9 12.268a2 2 0 1 1-2 0V8.874A4.002 4.002 0 0 1 4 5V3.732a2 2 0 1 1 2 0V5a2 2 0 1 0 4 0V3.732a2 2 0 1 1 2 0V5a4.002 4.002 0 0 1-3 3.874v3.394zM11 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zM5 3a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm3 12a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="geo-nodes" xmlns="http://www.w3.org/2000/svg"><path d="M9.7 13.1l-.2.2c-.7.8-2 .9-2.8.1-.1 0-.1-.1-.1-.1l-.2-.2c-2 .2-3.4.7-3.4 1.4 0 .8 2.2 1.5 5 1.5s5-.7 5-1.5c0-.7-1.4-1.2-3.3-1.4M7.3 12.7c.4.4 1 .3 1.4-.1C11.6 9.5 13 7 13 5.3 13 2.4 10.8 0 8 0S3 2.4 3 5.3C3 7 4.4 9.5 7.3 12.7M8 2c1.6 0 3 1.4 3 3.3 0 1-1 2.8-3 5.2-2-2.4-3-4.2-3-5.2C5 3.4 6.4 2 8 2"/><circle cx="8" cy="5" r="1"/></symbol><symbol viewBox="0 0 16 16" id="git-merge" xmlns="http://www.w3.org/2000/svg"><path d="M11 12.268V5a1 1 0 0 0-1-1v1a.5.5 0 0 1-.8.4l-2.667-2a.5.5 0 0 1 0-.8L9.2.6a.5.5 0 0 1 .8.4v1a3 3 0 0 1 3 3v7.268a2 2 0 1 1-2 0zm-6 0a2 2 0 1 1-2 0V4.732a2 2 0 1 1 2 0v7.536zM4 4a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm0 11a1 1 0 1 0 0-2 1 1 0 0 0 0 2zm8 0a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="group" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3.048 11.997C-.377 11.975.013 11.782.013 10.56.013 9.235.653 8 4 8c.444 0 .84.022 1.194.062.164.435.426.82.76 1.132-1.786.389-2.721 1.353-2.906 2.803zm2.94-7.222a2.993 2.993 0 0 0-.976 1.95 2 2 0 1 1 .975-1.95zm6.964 7.222c-.185-1.45-1.12-2.414-2.906-2.803.334-.311.596-.697.76-1.132C11.16 8.022 11.556 8 12 8c3.346 0 3.987 1.235 3.987 2.56 0 1.222.39 1.415-3.035 1.437zm-1.964-5.272a2.993 2.993 0 0 0-.976-1.95 2 2 0 1 1 .976 1.95zM8 9a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 5c-2.177 0-3.987-.115-3.987-1.44S4.653 10 8 10c3.346 0 3.987 1.235 3.987 2.56S10.177 14 8 14z"/></symbol><symbol viewBox="0 0 16 16" id="history" xmlns="http://www.w3.org/2000/svg"><path d="M2.868 3.24a7 7 0 1 1-.043 9.475 1 1 0 0 1 1.478-1.348 5 5 0 1 0 .124-6.865l.796.645a.5.5 0 0 1-.193.873l-3.232.814a.5.5 0 0 1-.622-.504L1.3 3a.5.5 0 0 1 .814-.37l.754.61zM9 8h1a1 1 0 0 1 0 2H8a.997.997 0 0 1-1-1V6a1 1 0 1 1 2 0v2z"/></symbol><symbol viewBox="0 0 16 16" id="home" xmlns="http://www.w3.org/2000/svg"><path d="M8.462 2.177a.505.505 0 0 1-.038.044l.038-.044zm-.787 0l.038.043a.5.5 0 0 1-.038-.043zM3.706 7h8.725L8.069 2.585 3.706 7zM7 13.369V12a1 1 0 0 1 2 0v1.369h3V9H4v4.369h3zM14 9v4.836c0 .833-.657 1.533-1.5 1.533h-9c-.843 0-1.5-.7-1.5-1.533V9h-.448a1.1 1.1 0 0 1-.783-1.873L6.934.887a1.5 1.5 0 0 1 2.269 0l6.165 6.24A1.1 1.1 0 0 1 14.585 9H14z"/></symbol><symbol viewBox="0 0 16 16" id="hook" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 3a1 1 0 0 0-1-1H7a1 1 0 0 0-1 1h4zm0 1H6v1a1 1 0 0 0 1 1h2a1 1 0 0 0 1-1V4zM7 8a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h2a3 3 0 0 1 3 3v2a3 3 0 0 1-3 3v4a2 2 0 1 0 4 0h-.44a.3.3 0 0 1-.25-.466l1.44-2.16a.3.3 0 0 1 .5 0l1.44 2.16a.3.3 0 0 1-.25.466H15a4 4 0 0 1-7 2.646A4 4 0 0 1 1 12H.56a.3.3 0 0 1-.25-.466l1.44-2.16a.3.3 0 0 1 .5 0l1.44 2.16a.3.3 0 0 1-.25.466H3a2 2 0 1 0 4 0V8z"/></symbol><symbol viewBox="0 0 24 30" id="image-comment-dark" xmlns="http://www.w3.org/2000/svg"><title>cursor_active</title><g fill="none" fill-rule="evenodd"><path d="M24 12.105c0 6.686-5.74 11.58-12 17.895C5.74 23.684 0 18.79 0 12.105 0 5.42 5.373 0 12 0s12 5.42 12 12.105z" fill="#FFF" fill-rule="nonzero"/><path d="M15.28 25.249c1.458-1.475 2.539-2.635 3.474-3.747 2.851-3.394 4.203-6.265 4.203-9.397 0-6.111-4.908-11.062-10.957-11.062-6.05 0-10.957 4.951-10.957 11.062 0 3.132 1.352 6.003 4.203 9.397.935 1.112 2.016 2.272 3.474 3.747.511.517 2.216 2.213 3.28 3.275 1.064-1.062 2.769-2.758 3.28-3.275z" fill="#1F78D1"/><path d="M14.551 8.256A6.874 6.874 0 0 0 12 7.787a6.92 6.92 0 0 0-2.558.469c-.79.308-1.42.725-1.888 1.252-.465.527-.697 1.096-.697 1.708 0 .5.159.977.476 1.433.321.45.772.841 1.352 1.172l.583.334-.181.643c-.107.407-.263.79-.469 1.152a6.604 6.604 0 0 0 1.842-1.145l.288-.254.381.04c.309.035.599.053.871.053.91 0 1.761-.154 2.551-.462.795-.312 1.424-.732 1.889-1.259.468-.526.703-1.096.703-1.707 0-.612-.235-1.181-.703-1.708-.465-.527-1.094-.944-1.889-1.252zm2.645.81c.536.656.804 1.373.804 2.15 0 .776-.268 1.495-.804 2.156-.535.656-1.263 1.176-2.183 1.56-.92.38-1.924.57-3.013.57a9.16 9.16 0 0 1-.971-.054 7.32 7.32 0 0 1-3.08 1.62 5.044 5.044 0 0 1-.764.148h-.033a.26.26 0 0 1-.181-.074.324.324 0 0 1-.107-.18v-.007c-.014-.018-.016-.045-.007-.08.014-.037.018-.059.014-.068a.19.19 0 0 1 .033-.067.645.645 0 0 0 .04-.06 1.73 1.73 0 0 0 .047-.054l.054-.06a53.034 53.034 0 0 1 .435-.489c.049-.049.118-.136.207-.26a2.57 2.57 0 0 0 .221-.342c.054-.103.114-.235.181-.395a4.18 4.18 0 0 0 .174-.51c-.7-.397-1.254-.888-1.66-1.473A3.261 3.261 0 0 1 6 11.216c0-.777.268-1.494.804-2.15.535-.66 1.263-1.18 2.183-1.56.92-.384 1.924-.576 3.013-.576 1.09 0 2.094.192 3.013.576.92.38 1.648.9 2.183 1.56z" fill="#FFF" fill-rule="nonzero"/></g></symbol><symbol viewBox="0 0 16 16" id="import" xmlns="http://www.w3.org/2000/svg"><path d="M9 8h1a.5.5 0 0 1 .4.8l-2 2.667a.5.5 0 0 1-.8 0L5.6 8.8A.5.5 0 0 1 6 8h1V1a1 1 0 1 1 2 0v7zM0 8a1 1 0 1 1 2 0 6 6 0 1 0 12 0 1 1 0 0 1 2 0A8 8 0 1 1 0 8z"/></symbol><symbol viewBox="0 0 16 16" id="issue-block" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.803 8a5.97 5.97 0 0 0-.462 1H4.5a.5.5 0 0 1 0-1h1.303zM4.5 5h3a.5.5 0 0 1 0 1h-3a.5.5 0 0 1 0-1zm7.5.083a6.04 6.04 0 0 0-2 0V3a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h2.083a5.96 5.96 0 0 0 .72 2H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h6a3 3 0 0 1 3 3v2.083zm1.121 3.796zM11 16a5 5 0 1 1 0-10 5 5 0 0 1 0 10zm-1.293-2.292a3 3 0 0 0 4.001-4.001l-4.001 4zm-1.415-1.415l4.001-4a3 3 0 0 0-4.001 4.001z"/></symbol><symbol viewBox="0 0 16 16" id="issue-child" xmlns="http://www.w3.org/2000/svg"><path d="M11 8H5v1h1a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1v-4a1 1 0 0 1 1-1h2V7a.997.997 0 0 1 1-1h3V4H4.5a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5h7a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5H9v2h3a.997.997 0 0 1 1 1v2h2a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-5a1 1 0 0 1-1-1v-4a1 1 0 0 1 1-1h1V8zm-9 3v2h3v-2H2zm9 0v2h3v-2h-3z"/></symbol><symbol viewBox="0 0 16 16" id="issue-close" xmlns="http://www.w3.org/2000/svg"><path d="M7.536 8.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 0 1 6.12 7.243l1.415 1.414zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="issue-duplicate" xmlns="http://www.w3.org/2000/svg"><path d="M10.874 2H12a3 3 0 0 1 3 3v8a3 3 0 0 1-3 3h-2c-.918 0-1.74-.413-2.29-1.063a3.987 3.987 0 0 0 1.988-.984A1 1 0 0 0 10 14h2a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1h-1V3c0-.345-.044-.68-.126-1zM4 0h3a3 3 0 0 1 3 3v8a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H4z"/></symbol><symbol viewBox="0 0 16 16" id="issue-new" xmlns="http://www.w3.org/2000/svg"><path d="M10 2V1a1 1 0 0 1 2 0v1h1a1 1 0 0 1 0 2h-1v1a1 1 0 0 1-2 0V4H9a1 1 0 1 1 0-2h1zm0 6a1 1 0 0 1 2 0v5a3 3 0 0 1-3 3H5a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h1a1 1 0 1 1 0 2H5a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V8z"/></symbol><symbol viewBox="0 0 16 16" id="issue-open" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm0-2a4 4 0 1 1 0-8 4 4 0 0 1 0 8zm0-2a2 2 0 1 0 0-4 2 2 0 0 0 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="issue-open-m" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="issue-parent" xmlns="http://www.w3.org/2000/svg"><path d="M11 11H5v1h1.5a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5h-6a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5H3v-2a.997.997 0 0 1 1-1h3V7H5a1 1 0 0 1-1-1V2a1 1 0 0 1 1-1h6a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H9v2h3a.997.997 0 0 1 1 1v2h2.5a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5h-6a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5H11v-1zM6 3v2h4V3H6z"/></symbol><symbol viewBox="0 0 16 16" id="issues" xmlns="http://www.w3.org/2000/svg"><path d="M10.458 15.012l.311.055a3 3 0 0 0 3.476-2.433l1.389-7.879A3 3 0 0 0 13.2 1.28L11.23.933a3.002 3.002 0 0 0-.824-.031c.364.59.58 1.28.593 2.02l1.854.328a1 1 0 0 1 .811 1.158l-1.389 7.879a1 1 0 0 1-1.158.81l-.118-.02a3.98 3.98 0 0 1-.541 1.935zM3 0h4a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="key" xmlns="http://www.w3.org/2000/svg"><path d="M7.575 6.689a4.002 4.002 0 0 1 6.274-4.86 4 4 0 0 1-4.86 6.274l-2.21 2.21.706.708a1 1 0 1 1-1.414 1.414l-.707-.707-.707.707.707.707a1 1 0 1 1-1.414 1.414l-.707-.707a1 1 0 0 1-1.414-1.414l5.746-5.746zm2.032-.618a2 2 0 1 0 2.828-2.828A2 2 0 0 0 9.607 6.07z"/></symbol><symbol viewBox="0 0 16 16" id="key-2" xmlns="http://www.w3.org/2000/svg"><path d="M5.172 14.157l-.344.344-2.485.133a.462.462 0 0 1-.497-.503l.14-2.24a.599.599 0 0 1 .177-.382l5.155-5.155a4 4 0 1 1 2.828 2.828l-1.439 1.44-1.06-.354-.708.707.354 1.06-.707.708-1.06-.354-.708.707.354 1.06zm6.01-8.839a1 1 0 1 0 1.414-1.414 1 1 0 0 0-1.414 1.414z"/></symbol><symbol viewBox="0 0 16 16" id="label" xmlns="http://www.w3.org/2000/svg"><path d="M11.782 14.718a3 3 0 0 1-4.242 0L1.652 8.829a2 2 0 0 1-.565-1.702l.54-3.703a2 2 0 0 1 1.69-1.69l3.703-.54a2 2 0 0 1 1.703.564l5.888 5.888a3 3 0 0 1 0 4.243l-2.829 2.829zm1.415-5.657L7.309 3.173l-3.703.54-.54 3.702 5.888 5.888a1 1 0 0 0 1.414 0l2.829-2.828a1 1 0 0 0 0-1.414zM5.732 5.525A1 1 0 1 1 7.146 6.94a1 1 0 0 1-1.414-1.414z"/></symbol><symbol viewBox="0 0 16 16" id="labels" xmlns="http://www.w3.org/2000/svg"><path d="M9.424 2.254l2.08-.905a1 1 0 0 1 1.206.326l3.013 4.12a1 1 0 0 1 .16.849l-1.947 7.264a3 3 0 0 1-3.675 2.122l-.5-.135a3.999 3.999 0 0 0 1.082-1.782 1 1 0 0 0 1.16-.722l1.823-6.802-2.258-3.087-.687.299a2 2 0 0 0-.628-.88l-.829-.667zM.377 3.7L4.4.498a1 1 0 0 1 1.25.003L9.627 3.7a1 1 0 0 1 .373.78V13a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V4.482A1 1 0 0 1 .377 3.7zM2 13a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1V4.958L5.02 2.561 2 4.964V13zm3-6a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="leave" xmlns="http://www.w3.org/2000/svg"><path d="M11 7V5.883a.5.5 0 0 1 .757-.429l3.528 2.117a.5.5 0 0 1 0 .858l-3.528 2.117a.5.5 0 0 1-.757-.43V9H7a1 1 0 1 1 0-2h4zm-2 6.256a1 1 0 0 1 2 0A2.744 2.744 0 0 1 8.256 16H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h5.19A2.81 2.81 0 0 1 11 2.81a1 1 0 0 1-2 0A.81.81 0 0 0 8.19 2H3a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h5.256c.41 0 .744-.333.744-.744z"/></symbol><symbol viewBox="0 0 16 16" id="level-up" xmlns="http://www.w3.org/2000/svg"><path fill="#2E2E2E" fill-rule="evenodd" d="M7 6h3.489a.5.5 0 0 0 .373-.832L6.374.117a.5.5 0 0 0-.748 0l-4.488 5.05A.5.5 0 0 0 1.51 6H5v7a3 3 0 0 0 3 3h6a1 1 0 0 0 0-2H8a1 1 0 0 1-1-1V6z"/></symbol><symbol viewBox="0 0 16 16" id="license" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M12.56 8.9l2.66 4.606a.3.3 0 0 1-.243.45l-1.678.094a.1.1 0 0 0-.078.044l-.953 1.432a.3.3 0 0 1-.51-.016L9.097 10.9a5.994 5.994 0 0 0 3.464-2zm-5.23 2.063L4.707 15.51a.3.3 0 0 1-.51.016l-.953-1.432a.1.1 0 0 0-.078-.044l-1.678-.094a.3.3 0 0 1-.243-.45l2.48-4.297a5.983 5.983 0 0 0 3.607 1.754zM8 10A5 5 0 1 1 8 0a5 5 0 0 1 0 10zm0-2a3 3 0 1 0 0-6 3 3 0 0 0 0 6zm0-1a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="link" xmlns="http://www.w3.org/2000/svg"><path d="M6.986 3.35l2.12-2.122a4 4 0 0 1 5.657 5.657l-2.828 2.829a4 4 0 0 1-5.657 0 1 1 0 0 1 1.414-1.415 2 2 0 0 0 2.829 0l2.828-2.828a2 2 0 1 0-2.828-2.828l-1.001 1a5.018 5.018 0 0 0-2.534-.294zm2.12 9.192l-2.12 2.121a4 4 0 1 1-5.658-5.656l2.829-2.829a4 4 0 0 1 5.657 0 1 1 0 1 1-1.415 1.414 2 2 0 0 0-2.828 0l-2.828 2.829a2 2 0 1 0 2.828 2.828l1.001-1.001a5.018 5.018 0 0 0 2.534.294z"/></symbol><symbol viewBox="0 0 16 16" id="list-bulleted" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 4a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm0 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4-7h10a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2zm0 5h10a1 1 0 0 1 0 2H5a1 1 0 1 1 0-2zm-4 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4-2h10a1 1 0 0 1 0 2H5a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="list-numbered" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 2h8a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm0 5h8a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm0 5h8a1 1 0 0 1 0 2H6a1 1 0 0 1 0-2zM1.156 5v-.828h.816V2.204h-.72v-.636c.432-.084.708-.192.996-.372h.756v2.976h.684V5H1.156zm-.18 5v-.588c.9-.828 1.596-1.464 1.596-1.98 0-.342-.192-.504-.468-.504-.252 0-.444.18-.624.36l-.552-.552c.396-.42.756-.612 1.32-.612.768 0 1.308.492 1.308 1.248 0 .612-.576 1.284-1.092 1.812.192-.024.468-.048.636-.048h.636V10H.976zm1.26 5.072c-.618 0-1.068-.204-1.356-.54l.468-.648c.234.216.51.36.78.36.336 0 .552-.12.552-.36 0-.288-.15-.456-.948-.456v-.72c.636 0 .828-.168.828-.432 0-.228-.138-.348-.396-.348-.252 0-.432.108-.672.312l-.516-.624c.372-.312.768-.492 1.236-.492.84 0 1.38.384 1.38 1.074 0 .366-.204.642-.612.822v.024c.432.132.732.432.732.912 0 .72-.684 1.116-1.476 1.116z"/></symbol><symbol viewBox="0 0 16 16" id="location" xmlns="http://www.w3.org/2000/svg"><path d="M8.755 15.144a1 1 0 0 1-1.51 0C3.748 11.114 2 8.065 2 6a6 6 0 1 1 12 0c0 2.065-1.748 5.113-5.245 9.144zM12 6a4 4 0 1 0-8 0c0 1.314 1.312 3.71 4 6.944C10.688 9.71 12 7.314 12 6zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="location-dot" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6.314 13.087C4.382 13.295 3 13.85 3 14.5c0 .828 2.239 1.5 5 1.5s5-.672 5-1.5c0-.65-1.382-1.205-3.314-1.413l-.202.225a2 2 0 0 1-2.968 0l-.202-.225zm2.428-.445a1 1 0 0 1-1.484 0C4.419 9.5 3 7.037 3 5.252 3 2.353 5.239 0 8 0s5 2.352 5 5.253c0 1.784-1.42 4.247-4.258 7.389zM11 5.252C11 3.436 9.634 2 8 2S5 3.435 5 5.253c0 1.027.974 2.824 3 5.203 2.026-2.38 3-4.176 3-5.203zM8 6a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="lock" xmlns="http://www.w3.org/2000/svg"><path d="M10 5V4h2v1a3 3 0 0 1 3 3v5a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V8a3 3 0 0 1 3-3V4h2v1h4zM4 7a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V8a1 1 0 0 0-1-1H4zm0-3a4 4 0 1 1 8 0h-2a2 2 0 1 0-4 0H4z"/></symbol><symbol viewBox="0 0 16 16" id="lock-open" xmlns="http://www.w3.org/2000/svg"><path d="M4.044 4a4 4 0 0 1 6.99-2.658 1 1 0 1 1-1.495 1.33A2 2 0 0 0 6.044 4a.998.998 0 0 1-.07.367v.701H12a3 3 0 0 1 3 3v5a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3v-5a3 3 0 0 1 2.974-3V4h.07zM4 7.07a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-5a1 1 0 0 0-1-1H4z"/></symbol><symbol viewBox="0 0 16 16" id="log" xmlns="http://www.w3.org/2000/svg"><path d="M4 0h8a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H4zm1 4a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm0 3a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3-5h3a1 1 0 0 1 0 2H8a1 1 0 1 1 0-2zm0 3h3a1 1 0 0 1 0 2H8a1 1 0 1 1 0-2zm-3 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm3-2h3a1 1 0 0 1 0 2H8a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="mail" xmlns="http://www.w3.org/2000/svg"><path d="M14 5.6L9.338 9.796a2 2 0 0 1-2.676 0L2 5.6V11a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V5.6zM3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm.212 2L8 8.31 12.788 4H3.212z"/></symbol><symbol viewBox="0 0 16 16" id="menu" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1.143 2h13.714C15.488 2 16 2.448 16 3s-.512 1-1.143 1H1.143C.512 4 0 3.552 0 3s.512-1 1.143-1zm0 5h13.714C15.488 7 16 7.448 16 8s-.512 1-1.143 1H1.143C.512 9 0 8.552 0 8s.512-1 1.143-1zm0 5h13.714c.631 0 1.143.448 1.143 1s-.512 1-1.143 1H1.143C.512 14 0 13.552 0 13s.512-1 1.143-1z"/></symbol><symbol viewBox="0 0 16 16" id="merge-request-close" xmlns="http://www.w3.org/2000/svg"><path d="M9.414 8l1.414 1.414a1 1 0 1 1-1.414 1.414L8 9.414l-1.414 1.414a1 1 0 1 1-1.414-1.414L6.586 8 5.172 6.586a1 1 0 1 1 1.414-1.414L8 6.586l1.414-1.414a1 1 0 1 1 1.414 1.414L9.414 8zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 16 16" id="messages" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.588 8.942l1.173 5.862A1 1 0 0 1 8.78 16H7.22a1 1 0 0 1-.98-1.196l1.172-5.862a3.014 3.014 0 0 0 1.176 0zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4zM4.464 2.464L5.88 3.88a3 3 0 0 0 0 4.242L4.464 9.536a5 5 0 0 1 0-7.072zm7.072 7.072L10.12 8.12a3 3 0 0 0 0-4.242l1.415-1.415a5 5 0 0 1 0 7.072zM2.343.343l1.414 1.414a6 6 0 0 0 0 8.486l-1.414 1.414a8 8 0 0 1 0-11.314zm11.314 11.314l-1.414-1.414a6 6 0 0 0 0-8.486L13.657.343a8 8 0 0 1 0 11.314z"/></symbol><symbol viewBox="0 0 16 16" id="mobile-issue-close" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5.657 10.728L2.12 7.192A1 1 0 1 0 .707 8.607l4.243 4.242a.997.997 0 0 0 1.414 0l8.485-8.485a1 1 0 1 0-1.414-1.414l-7.778 7.778z"/></symbol><symbol viewBox="0 0 16 16" id="monitor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 13v1h3a1 1 0 0 1 0 2H3a1 1 0 0 1 0-2h3v-1H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3h10a3 3 0 0 1 3 3v7a3 3 0 0 1-3 3h-3zM3 2a1 1 0 0 0-1 1v7a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3zm5.723 6.416l-2.66-1.773-1.71 1.71a.5.5 0 1 1-.707-.707l2-2a.5.5 0 0 1 .631-.062l2.66 1.773 2.71-2.71a.5.5 0 0 1 .707.707l-3 3a.5.5 0 0 1-.631.062z"/></symbol><symbol viewBox="0 0 16 16" id="more" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 4a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 6a2 2 0 1 1 0-4 2 2 0 0 1 0 4zm0 6a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="notifications" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 14H2.435a2 2 0 0 1-1.761-2.947c.962-1.788 1.521-3.065 1.68-3.832.322-1.566.947-5.501 4.65-6.134a1 1 0 1 1 1.994-.024c3.755.528 4.375 4.27 4.761 6.043.188.86.742 2.188 1.661 3.982A2 2 0 0 1 13.64 14H10a2 2 0 1 1-4 0zm5.805-6.468c-.325-1.492-.37-1.674-.61-2.288C10.6 3.716 9.742 3 8.07 3c-1.608 0-2.49.718-3.103 2.197-.28.676-.356.982-.654 2.428-.208 1.012-.827 2.424-1.877 4.375H13.64c-.993-1.937-1.6-3.396-1.835-4.468z"/></symbol><symbol viewBox="0 0 16 16" id="notifications-off" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.26 5.089c.243.757.382 1.478.5 2.017.187.86.74 2.188 1.66 3.982A2 2 0 0 1 13.64 14H10a2 2 0 1 1-4 0H4.35l2-2h7.29c-.993-1.937-1.6-3.396-1.835-4.468-.07-.326-.129-.59-.178-.81l1.634-1.633zM10.943 1.75l-1.48 1.48C9.07 3.076 8.612 3 8.069 3c-1.608 0-2.49.718-3.103 2.197-.28.676-.356.982-.654 2.428-.065.317-.17.673-.317 1.073L.45 12.242a1.99 1.99 0 0 1 .224-1.19c.962-1.787 1.521-3.064 1.68-3.831.322-1.566.947-5.501 4.65-6.134a1 1 0 1 1 1.994-.024 4.867 4.867 0 0 1 1.944.688zm2.932-.105a1 1 0 0 1 0 1.415L2.561 14.374a1 1 0 1 1-1.415-1.414L12.46 1.646a1 1 0 0 1 1.414 0z"/></symbol><symbol viewBox="0 0 16 16" id="overview" xmlns="http://www.w3.org/2000/svg"><path d="M2 0h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2zm0 2v3h3V2H2zm9-2h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2h-3a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2zm0 2v3h3V2h-3zM2 9h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v-3a2 2 0 0 1 2-2zm0 2v3h3v-3H2zm9-2h3a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2h-3a2 2 0 0 1-2-2v-3a2 2 0 0 1 2-2zm0 2v3h3v-3h-3z"/></symbol><symbol viewBox="0 0 16 16" id="pencil" xmlns="http://www.w3.org/2000/svg"><path d="M13.02 1.293l1.414 1.414a1 1 0 0 1 0 1.414L4.119 14.436a1 1 0 0 1-.704.293l-2.407.008L1 12.316a1 1 0 0 1 .293-.71L11.605 1.292a1 1 0 0 1 1.414 0zm-1.416 1.415l-.707.707L12.31 4.83l.707-.707-1.414-1.415zM3.411 13.73l1.123-1.122H3.12v-1.415L2 12.312l.005 1.422 1.406-.005z"/></symbol><symbol viewBox="0 0 16 16" id="pipeline" xmlns="http://www.w3.org/2000/svg"><path d="M8.969 7.25a2 2 0 1 1-1.938 0A1.002 1.002 0 0 1 7 7V5.083a.2.2 0 0 1 .06-.142l.877-.87a.1.1 0 0 1 .141 0l.864.87A.2.2 0 0 1 9 5.083V7c0 .086-.01.17-.031.25zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm4.5-4a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-3a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-2 6a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-5 9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-9a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm-2 6a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zm0-3a.5.5 0 1 1 0-1 .5.5 0 0 1 0 1zM8 10a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="play" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2.765 15.835c-.545.321-1.258.159-1.593-.363A1.075 1.075 0 0 1 1 14.89V1.11C1 .496 1.518 0 2.158 0c.214 0 .424.057.607.165l11.684 6.89c.544.321.714 1.005.38 1.526a1.135 1.135 0 0 1-.38.364l-11.684 6.89z"/></symbol><symbol viewBox="0 0 16 16" id="plus" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7 7V1a1 1 0 1 1 2 0v6h6a1 1 0 0 1 0 2H9v6a1 1 0 0 1-2 0V9H1a1 1 0 1 1 0-2h6z"/></symbol><symbol viewBox="0 0 16 16" id="plus-square" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 7V4a1 1 0 1 0-2 0v3H4a1 1 0 1 0 0 2h3v3a1 1 0 0 0 2 0V9h3a1 1 0 0 0 0-2H9zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3z"/></symbol><symbol viewBox="0 0 16 16" id="plus-square-o" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7 7V5a1 1 0 1 1 2 0v2h2a1 1 0 0 1 0 2H9v2a1 1 0 0 1-2 0V9H5a1 1 0 1 1 0-2h2zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="preferences" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M5 12h10a1 1 0 0 1 0 2H5a1 1 0 0 1-2 0v-2a1 1 0 0 1 2 0zm-3 0H1a1 1 0 0 0 0 2h1v-2zm11-5h2a1 1 0 0 1 0 2h-2a1 1 0 0 1-2 0V7a1 1 0 0 1 2 0zm-3 0H1a1 1 0 1 0 0 2h9V7zM6 2h9a1 1 0 0 1 0 2H6a1 1 0 1 1-2 0V2a1 1 0 1 1 2 0zM3 2H1a1 1 0 1 0 0 2h2V2z"/></symbol><symbol viewBox="0 0 16 16" id="profile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-4.274-3.404C4.412 9.709 5.694 9 8 9c2.313 0 3.595.7 4.28 1.586A4.997 4.997 0 0 1 8 13a4.997 4.997 0 0 1-4.274-2.404zM8 8a2 2 0 1 1 0-4 2 2 0 0 1 0 4z"/></symbol><symbol viewBox="0 0 16 16" id="project" xmlns="http://www.w3.org/2000/svg"><path d="M8.462 2.177l-.038.044a.505.505 0 0 0 .038-.044zm-.787 0a.5.5 0 0 0 .038.043l-.038-.043zM3.706 7h8.725L8.069 2.585 3.706 7zM7 13.369V12a1 1 0 0 1 2 0v1.369h3V9H4v4.369h3zM14 9v4.836c0 .833-.657 1.533-1.5 1.533h-9c-.843 0-1.5-.7-1.5-1.533V9h-.448a1.1 1.1 0 0 1-.783-1.873L6.934.887a1.5 1.5 0 0 1 2.269 0l6.165 6.24A1.1 1.1 0 0 1 14.585 9H14z"/></symbol><symbol viewBox="0 0 16 16" id="push-rules" xmlns="http://www.w3.org/2000/svg"><path d="M6.268 9a2 2 0 0 1 3.464 0H11a1 1 0 0 1 0 2H9.732a2 2 0 0 1-3.464 0H5a1 1 0 0 1 0-2h1.268zM7 2H4a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1h-1v3.515a.3.3 0 0 1-.434.268l-1.432-.716a.3.3 0 0 0-.268 0l-1.432.716A.3.3 0 0 1 7 5.515V2zM4 0h8a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm4 11a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="question" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm-1.46-5.602h2.233a3.97 3.97 0 0 1 .051-.558c.029-.17.073-.326.133-.469.06-.143.14-.28.242-.41.102-.13.228-.263.38-.399.26-.24.504-.467.733-.683a5.03 5.03 0 0 0 .598-.668c.17-.23.302-.477.399-.742a2.66 2.66 0 0 0 .144-.907c0-.505-.083-.95-.25-1.335a2.55 2.55 0 0 0-.723-.97 3.2 3.2 0 0 0-1.152-.589 5.441 5.441 0 0 0-1.531-.2c-.516 0-.998.063-1.445.188a3.19 3.19 0 0 0-1.168.59c-.331.268-.594.61-.79 1.027-.195.417-.295.917-.3 1.5h2.64c.006-.224.04-.416.102-.578.062-.161.142-.293.238-.394a.921.921 0 0 1 .332-.227 1.04 1.04 0 0 1 .39-.074c.34 0 .593.095.763.285.169.19.254.488.254.895 0 .328-.106.63-.317.906-.21.276-.499.565-.863.867-.214.182-.39.374-.531.574-.141.2-.253.42-.336.657a3.656 3.656 0 0 0-.176.777 7.89 7.89 0 0 0-.05.937zm-.321 2.375c0 .188.035.362.105.524.07.161.17.3.301.418.13.117.284.21.46.277.178.068.376.102.595.102.218 0 .416-.034.593-.102.178-.068.331-.16.461-.277a1.2 1.2 0 0 0 .301-.418c.07-.162.106-.336.106-.524a1.3 1.3 0 0 0-.106-.523 1.2 1.2 0 0 0-.3-.418 1.461 1.461 0 0 0-.462-.277 1.651 1.651 0 0 0-.593-.102c-.22 0-.417.034-.594.102a1.46 1.46 0 0 0-.461.277 1.2 1.2 0 0 0-.3.418 1.284 1.284 0 0 0-.106.523z"/></symbol><symbol viewBox="0 0 16 16" id="question-o" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-.778-4.151c0-.301.014-.575.044-.82a3.2 3.2 0 0 1 .154-.68c.073-.208.17-.4.294-.575.123-.176.278-.343.465-.503a4.81 4.81 0 0 0 .755-.758c.185-.242.277-.506.277-.793 0-.356-.074-.617-.222-.783-.148-.166-.37-.25-.667-.25a.92.92 0 0 0-.342.065.806.806 0 0 0-.29.199 1.04 1.04 0 0 0-.209.345 1.5 1.5 0 0 0-.088.506H5.082c.005-.51.092-.948.263-1.313.171-.364.401-.664.69-.899.29-.234.63-.406 1.023-.516a4.66 4.66 0 0 1 1.264-.164c.497 0 .944.058 1.34.174.397.117.733.289 1.008.517.276.227.487.51.633.847.146.337.218.727.218 1.17 0 .295-.042.56-.126.792a2.52 2.52 0 0 1-.349.65 4.4 4.4 0 0 1-.523.584c-.2.19-.414.389-.642.598a2.73 2.73 0 0 0-.332.349c-.089.114-.16.233-.212.359a1.868 1.868 0 0 0-.116.41 3.39 3.39 0 0 0-.044.489H7.222zm-.28 2.078c0-.164.03-.317.092-.458a1.05 1.05 0 0 1 .263-.366c.114-.103.248-.183.403-.243a1.45 1.45 0 0 1 .52-.089c.191 0 .364.03.52.09.154.059.289.14.403.242.114.103.201.224.263.366.061.141.092.294.092.458 0 .164-.03.316-.092.458a1.05 1.05 0 0 1-.263.365 1.278 1.278 0 0 1-.404.243 1.43 1.43 0 0 1-.52.089c-.19 0-.364-.03-.519-.089-.155-.06-.29-.14-.403-.243a1.05 1.05 0 0 1-.263-.365 1.135 1.135 0 0 1-.093-.458z"/></symbol><symbol viewBox="0 0 16 16" id="quote" xmlns="http://www.w3.org/2000/svg"><path d="M15 3v8a3 3 0 0 1-3 3 1 1 0 0 1 0-2 1 1 0 0 0 1-1V9h-2a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h3a1 1 0 0 1 1 1zM7 3v8a3 3 0 0 1-3 3 1 1 0 0 1 0-2 1 1 0 0 0 1-1V9H3a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h3a1 1 0 0 1 1 1z"/></symbol><symbol viewBox="0 0 16 16" id="redo" xmlns="http://www.w3.org/2000/svg"><path d="M4.666 4.423a5 5 0 1 1-.203 6.944 1 1 0 1 0-1.478 1.347 7 7 0 1 0 .12-9.556L1.842 2.137a.5.5 0 0 0-.815.385L1 7.26a.5.5 0 0 0 .607.492l4.629-1.013a.5.5 0 0 0 .207-.877L4.666 4.423z"/></symbol><symbol viewBox="0 0 16 16" id="remove" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 3a1 1 0 1 1 0-2h12a1 1 0 0 1 0 2v10a3 3 0 0 1-3 3H5a3 3 0 0 1-3-3V3zm3-2a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1H5zM4 3v10a1 1 0 0 0 1 1h6a1 1 0 0 0 1-1V3H4zm2.5 2a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5zm3 0a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5z"/></symbol><symbol viewBox="0 0 16 16" id="repeat" xmlns="http://www.w3.org/2000/svg"><path d="M11.494 4.423a5 5 0 1 0 .203 6.944 1 1 0 1 1 1.478 1.347 7 7 0 1 1-.12-9.556l1.262-1.021a.5.5 0 0 1 .815.385l.028 4.738a.5.5 0 0 1-.607.492L9.924 6.739a.5.5 0 0 1-.207-.877l1.777-1.439z"/></symbol><symbol viewBox="0 0 16 16" id="retry" xmlns="http://www.w3.org/2000/svg"><path d="M4.009 6.958a4 4 0 0 0 5.283 4.775 1 1 0 0 1 .712 1.87A6 6 0 0 1 2.077 6.44l-.741-.2a.5.5 0 0 1-.12-.915L3.41 4.058a.5.5 0 0 1 .683.183l1.268 2.196a.5.5 0 0 1-.563.733l-.79-.212zm7.777 2.084a4 4 0 0 0-5.284-4.775 1 1 0 0 1-.711-1.87 6 6 0 0 1 7.927 7.162l.74.2a.5.5 0 0 1 .121.915l-2.196 1.268a.5.5 0 0 1-.683-.183l-1.267-2.196a.5.5 0 0 1 .562-.733l.79.212z"/></symbol><symbol viewBox="0 0 16 16" id="scale" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M13.99 9a.792.792 0 0 0-.078-.231L13 7l-.912 1.769a.791.791 0 0 0-.077.231h1.978zm-10 0a.792.792 0 0 0-.078-.231L3 7l-.912 1.769A.791.791 0 0 0 2.011 9h1.978zM2 0h12a1 1 0 0 1 0 2H2a1 1 0 1 1 0-2zm3 14h6a1 1 0 0 1 0 2H5a1 1 0 0 1 0-2zM8 4a1 1 0 0 1 1 1v9H7V5a1 1 0 0 1 1-1zm-4.53-.714l2.265 4.735c.68 1.42.006 3.091-1.504 3.73A3.161 3.161 0 0 1 3 12c-1.657 0-3-1.263-3-2.821 0-.4.09-.794.264-1.158L2.53 3.286a.53.53 0 0 1 .94 0zm10 0l2.265 4.735c.68 1.42.006 3.091-1.504 3.73A3.161 3.161 0 0 1 13 12c-1.657 0-3-1.263-3-2.821 0-.4.09-.794.264-1.158l2.266-4.735a.53.53 0 0 1 .94 0z"/></symbol><symbol viewBox="0 0 16 16" id="screen-full" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M14 14v-2a1 1 0 0 1 2 0v3a.997.997 0 0 1-1 1h-3a1 1 0 0 1 0-2h2zM2 14v-2a1 1 0 0 0-2 0v3a1 1 0 0 0 1 1h3a1 1 0 0 0 0-2H2zM15.707.293A.997.997 0 0 1 16 1v3a1 1 0 0 1-2 0V2h-2a1 1 0 0 1 0-2h3c.276 0 .526.112.707.293zM2 2v2a1 1 0 1 1-2 0V1a.997.997 0 0 1 1-1h3a1 1 0 1 1 0 2H2zm4 4h4a1 1 0 0 1 1 1v2a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="screen-normal" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M3 3V1a1 1 0 1 1 2 0v3a.997.997 0 0 1-1 1H1a1 1 0 1 1 0-2h2zm10 0h2a1 1 0 0 1 0 2h-3a.997.997 0 0 1-1-1V1a1 1 0 0 1 2 0v2zM3 13H1a1 1 0 0 1 0-2h3a.997.997 0 0 1 1 1v3a1 1 0 0 1-2 0v-2zm10 0v2a1 1 0 0 1-2 0v-3a.997.997 0 0 1 1-1h3a1 1 0 0 1 0 2h-2zM6.5 7h3a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5z"/></symbol><symbol viewBox="0 0 12 16" id="scroll_down" xmlns="http://www.w3.org/2000/svg"><path class="ehfirst-triangle" d="M1.048 14.155a.508.508 0 0 0-.32.105c-.091.07-.136.154-.136.25v.71c0 .095.045.178.135.249.09.07.197.105.321.105h10.043a.51.51 0 0 0 .321-.105c.09-.07.136-.154.136-.25v-.71c0-.095-.045-.178-.136-.249a.508.508 0 0 0-.32-.105"/><path class="ehsecond-triangle" d="M.687 8.027c-.09-.087-.122-.16-.093-.22.028-.06.104-.09.228-.09h10.5c.123 0 .2.03.228.09.029.06-.002.133-.093.22L6.393 12.91a.458.458 0 0 1-.136.089h-.37a.626.626 0 0 1-.136-.09"/><path class="ehthird-triangle" d="M.687 1.027C.597.94.565.867.594.807c.028-.06.104-.09.228-.09h10.5c.123 0 .2.03.228.09.029.06-.002.133-.093.22L6.393 5.91a.458.458 0 0 1-.136.09h-.37a.626.626 0 0 1-.136-.09"/></symbol><symbol viewBox="0 0 12 16" id="scroll_up" xmlns="http://www.w3.org/2000/svg"><path d="M1.048 1.845a.508.508 0 0 1-.32-.105c-.091-.07-.136-.154-.136-.25V.78c0-.095.045-.178.135-.249a.508.508 0 0 1 .321-.105h10.043a.51.51 0 0 1 .321.105c.09.07.136.154.136.25v.71c0 .095-.045.178-.136.249a.508.508 0 0 1-.32.105M.687 7.973c-.09.087-.122.16-.093.22.028.06.104.09.228.09h10.5c.123 0 .2-.03.228-.09.029-.06-.002-.133-.093-.22L6.393 3.09A.458.458 0 0 0 6.257 3h-.37a.626.626 0 0 0-.136.09M.687 14.973c-.09.087-.122.16-.093.22.028.06.104.09.228.09h10.5c.123 0 .2-.03.228-.09.029-.06-.002-.133-.093-.22L6.393 10.09a.458.458 0 0 0-.136-.09h-.37a.626.626 0 0 0-.136.09"/></symbol><symbol viewBox="0 0 16 16" id="search" xmlns="http://www.w3.org/2000/svg"><path d="M8.853 8.854a3.5 3.5 0 1 0-4.95-4.95 3.5 3.5 0 0 0 4.95 4.95zm.207 2.328a5.5 5.5 0 1 1 2.121-2.121l3.329 3.328a1.5 1.5 0 0 1-2.121 2.121L9.06 11.182z"/></symbol><symbol viewBox="0 0 16 16" id="settings" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2.415 5.803L1.317 4.084A.5.5 0 0 1 1.35 3.5l.805-.994a.5.5 0 0 1 .564-.153l1.878.704a5.975 5.975 0 0 1 1.65-.797L6.885.342A.5.5 0 0 1 7.36 0h1.28a.5.5 0 0 1 .474.342l.639 1.918a5.97 5.97 0 0 1 1.65.797l1.877-.704a.5.5 0 0 1 .565.153l.805.994a.5.5 0 0 1 .032.584l-1.097 1.719c.217.551.354 1.143.399 1.76l1.731 1.058a.5.5 0 0 1 .227.54l-.288 1.246a.5.5 0 0 1-.44.385l-2.008.19a6.026 6.026 0 0 1-1.142 1.431l.265 1.995a.5.5 0 0 1-.277.516l-1.15.56a.5.5 0 0 1-.576-.1l-1.424-1.452a6.047 6.047 0 0 1-1.804 0l-1.425 1.453a.5.5 0 0 1-.576.1l-1.15-.561a.5.5 0 0 1-.276-.516l.265-1.995a6.026 6.026 0 0 1-1.143-1.43l-2.008-.191a.5.5 0 0 1-.44-.385L.058 9.16a.5.5 0 0 1 .226-.539l1.732-1.058a5.968 5.968 0 0 1 .399-1.76zM8 11a3 3 0 1 0 0-6 3 3 0 0 0 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="shield" xmlns="http://www.w3.org/2000/svg"><path d="M4 0h8a3 3 0 0 1 3 3v7.186a3 3 0 0 1-1.426 2.554l-4 2.465a3 3 0 0 1-3.148 0l-4-2.465A3 3 0 0 1 1 10.186V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v7.186a1 1 0 0 0 .475.852l4 2.464a1 1 0 0 0 1.05 0l4-2.464a1 1 0 0 0 .475-.852V3a1 1 0 0 0-1-1H4zm0 1.5a.5.5 0 0 1 .5-.5h4v8.837a.5.5 0 0 1-.753.431l-3.5-2.052A.5.5 0 0 1 4 9.785V3.5z"/></symbol><symbol viewBox="0 0 16 16" id="slight-frown" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zm-2.163-3.275a2.499 2.499 0 0 1 4.343.03.5.5 0 0 1-.871.49 1.5 1.5 0 0 0-2.607-.018.5.5 0 1 1-.865-.502zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="slight-smile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm-5.163 2.254a.5.5 0 1 1 .865-.502 1.499 1.499 0 0 0 2.607-.018.5.5 0 1 1 .871.49 2.499 2.499 0 0 1-4.343.03z"/></symbol><symbol viewBox="0 0 16 16" id="smile" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM6.18 6.27a.5.5 0 0 1-.873.487.5.5 0 0 0-.872-.003.5.5 0 1 1-.87-.495 1.5 1.5 0 0 1 2.616.012zm6 0a.5.5 0 1 1-.873.487.5.5 0 0 0-.872-.003.5.5 0 1 1-.87-.495 1.5 1.5 0 0 1 2.616.012zM5 9a3 3 0 0 0 6 0H5z"/></symbol><symbol viewBox="0 0 16 16" id="smiley" xmlns="http://www.w3.org/2000/svg"><path d="M8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM5 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm6 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zM5 9h6a3 3 0 0 1-6 0z"/></symbol><symbol viewBox="0 0 16 16" id="snippet" xmlns="http://www.w3.org/2000/svg"><path d="M10.67 9.31a3.001 3.001 0 0 1 2.062 5.546 3 3 0 0 1-3.771-4.559 1.007 1.007 0 0 1-.095-.137l-4.5-7.794a1 1 0 0 1 1.732-1l4.5 7.794c.028.05.052.1.071.15zm-3.283.35l-.289.5c-.028.05-.06.095-.095.137a3.001 3.001 0 0 1-3.77 4.56A3 3 0 0 1 5.294 9.31c.02-.051.043-.102.071-.15l.866-1.5 1.155 2zm2.31-4l-1.156-2 1.325-2.294a1 1 0 0 1 1.732 1L9.696 5.66zm-5.465 7.464a1 1 0 1 0 1-1.732 1 1 0 0 0-1 1.732zm7.5 0a1 1 0 1 0-1-1.732 1 1 0 0 0 1 1.732z"/></symbol><symbol viewBox="0 0 16 16" id="spam" xmlns="http://www.w3.org/2000/svg"><path d="M8.75.433l5.428 3.134a1.5 1.5 0 0 1 .75 1.299v6.268a1.5 1.5 0 0 1-.75 1.299L8.75 15.567a1.5 1.5 0 0 1-1.5 0l-5.428-3.134a1.5 1.5 0 0 1-.75-1.299V4.866a1.5 1.5 0 0 1 .75-1.299L7.25.433a1.5 1.5 0 0 1 1.5 0zM3.072 5.155v5.69L8 13.691l4.928-2.846v-5.69L8 2.309 3.072 5.155zM8 4a1 1 0 0 1 1 1v3a1 1 0 1 1-2 0V5a1 1 0 0 1 1-1zm0 8a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="star" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M7.609 14.394l-3.465 1.473a1 1 0 0 1-1.39-.989l.276-4.024a1 1 0 0 0-.219-.694L.303 7.037A1 1 0 0 1 .83 5.443l3.715-.964a1 1 0 0 0 .609-.457L7.14.682a1 1 0 0 1 1.72 0l1.985 3.34a1 1 0 0 0 .609.457l3.715.964a1 1 0 0 1 .528 1.594L13.19 10.16a1 1 0 0 0-.219.694l.275 4.024a1 1 0 0 1-1.389.989l-3.465-1.473a1 1 0 0 0-.782 0z"/></symbol><symbol viewBox="0 0 16 16" id="star-o" xmlns="http://www.w3.org/2000/svg"><path d="M10.975 10.99a3 3 0 0 1 .655-2.083l1.54-1.916-2.219-.576a3 3 0 0 1-1.825-1.37L8 3.15 6.874 5.044a3 3 0 0 1-1.825 1.371l-2.218.576 1.54 1.916a3 3 0 0 1 .654 2.083l-.165 2.4 1.965-.836a3 3 0 0 1 2.348 0l1.965.836-.164-2.399zM7.61 14.394l-3.465 1.473a1 1 0 0 1-1.39-.989l.276-4.024a1 1 0 0 0-.219-.694L.303 7.037A1 1 0 0 1 .83 5.443l3.715-.964a1 1 0 0 0 .609-.457L7.14.682a1 1 0 0 1 1.72 0l1.985 3.34a1 1 0 0 0 .609.457l3.715.964a1 1 0 0 1 .528 1.594L13.19 10.16a1 1 0 0 0-.219.694l.275 4.024a1 1 0 0 1-1.389.989l-3.465-1.473a1 1 0 0 0-.782 0z"/></symbol><symbol viewBox="0 0 14 14" id="status_canceled" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M5.2 3.8l4.9 4.9c.2.2.2.5 0 .7l-.7.7c-.2.2-.5.2-.7 0L3.8 5.2c-.2-.2-.2-.5 0-.7l.7-.7c.2-.2.5-.2.7 0"/></g></symbol><symbol viewBox="0 0 22 22" id="status_canceled_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M8.171 5.971l7.7 7.7a.76.76 0 0 1 0 1.1l-1.1 1.1a.76.76 0 0 1-1.1 0l-7.7-7.7a.76.76 0 0 1 0-1.1l1.1-1.1a.76.76 0 0 1 1.1 0"/></symbol><symbol viewBox="0 0 16 16" id="status_closed" xmlns="http://www.w3.org/2000/svg"><path d="M7.536 8.657l2.828-2.83a1 1 0 0 1 1.414 1.416l-3.535 3.535a1 1 0 0 1-1.415.001l-2.12-2.12a1 1 0 1 1 1.413-1.415zM8 16A8 8 0 1 1 8 0a8 8 0 0 1 0 16zm0-2A6 6 0 1 0 8 2a6 6 0 0 0 0 12z"/></symbol><symbol viewBox="0 0 14 14" id="status_created" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><circle cx="7" cy="7" r="3.25"/></g></symbol><symbol viewBox="0 0 22 22" id="status_created_borderless" xmlns="http://www.w3.org/2000/svg"><circle cx="11" cy="11" r="5.107"/></symbol><symbol viewBox="0 0 14 14" id="status_failed" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M7 5.969L5.599 4.568a.29.29 0 0 0-.413.004l-.614.614a.294.294 0 0 0-.004.413L5.968 7l-1.4 1.401a.29.29 0 0 0 .004.413l.614.614c.113.114.3.117.413.004L7 8.032l1.401 1.4a.29.29 0 0 0 .413-.004l.614-.614a.294.294 0 0 0 .004-.413L8.032 7l1.4-1.401a.29.29 0 0 0-.004-.413l-.614-.614a.294.294 0 0 0-.413-.004L7 5.968z"/></g></symbol><symbol viewBox="0 0 22 22" id="status_failed_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M11 9.38L8.798 7.178a.455.455 0 0 0-.65.006l-.964.965a.462.462 0 0 0-.006.65L9.38 11l-2.202 2.202a.455.455 0 0 0 .006.65l.965.964a.462.462 0 0 0 .65.006L11 12.62l2.202 2.202a.455.455 0 0 0 .65-.006l.964-.965a.462.462 0 0 0 .006-.65L12.62 11l2.202-2.202a.455.455 0 0 0-.006-.65l-.965-.964a.462.462 0 0 0-.65-.006L11 9.38z"/></symbol><symbol viewBox="0 0 14 14" id="status_manual" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M10.5 7.63V6.37l-.787-.13c-.044-.175-.132-.349-.263-.61l.481-.652-.918-.913-.657.478a2.346 2.346 0 0 0-.612-.26L7.656 3.5H6.388l-.132.783c-.219.043-.394.13-.612.26l-.657-.478-.918.913.437.652c-.131.218-.175.392-.262.61l-.744.086v1.261l.787.13c.044.218.132.392.263.61l-.438.651.92.913.655-.434c.175.086.394.173.613.26l.131.783h1.313l.131-.783c.219-.043.394-.13.613-.26l.656.478.918-.913-.48-.652c.13-.218.218-.435.262-.61l.656-.13zM7 8.283a1.285 1.285 0 0 1-1.313-1.305c0-.739.57-1.304 1.313-1.304.744 0 1.313.565 1.313 1.304 0 .74-.57 1.305-1.313 1.305z"/></g></symbol><symbol viewBox="0 0 22 22" id="status_manual_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M16.5 11.99v-1.98l-1.238-.206c-.068-.273-.206-.546-.412-.956l.756-1.025-1.444-1.435-1.03.752a3.686 3.686 0 0 0-.963-.41L12.03 5.5h-1.994l-.206 1.23c-.343.068-.618.205-.962.41l-1.031-.752-1.444 1.435.687 1.025c-.206.341-.275.615-.412.956L5.5 9.941v1.981l1.237.205c.07.342.207.615.413.957l-.688 1.025 1.444 1.434 1.032-.683c.274.137.618.274.962.41l.206 1.23h2.063l.206-1.23c.344-.068.619-.205.963-.41l1.03.752 1.444-1.435-.756-1.025c.207-.341.344-.683.413-.956l1.031-.205zM11 13.017c-1.169 0-2.063-.889-2.063-2.05 0-1.162.894-2.05 2.063-2.05s2.063.888 2.063 2.05c0 1.161-.894 2.05-2.063 2.05z"/></symbol><symbol viewBox="0 0 22 22" id="status_notfound_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M12.822 11.29c.816-.581 1.421-1.348 1.683-2.322.603-2.243-.973-4.553-3.53-4.553-1.15 0-2.085.41-2.775 1.089-.42.413-.672.835-.8 1.167a1.179 1.179 0 0 0 2.2.847c.016-.043.1-.184.252-.334.264-.259.613-.412 1.123-.412.938 0 1.47.78 1.254 1.584-.105.39-.37.726-.773 1.012a3.25 3.25 0 0 1-.945.47 1.179 1.179 0 0 0-.874 1.138v2.234a1.179 1.179 0 1 0 2.358 0v-1.43a5.9 5.9 0 0 0 .827-.492z"/><ellipse cx="10.825" cy="16.711" rx="1.275" ry="1.322"/></symbol><symbol viewBox="0 0 14 14" id="status_open" xmlns="http://www.w3.org/2000/svg"><path d="M0 7c0-3.866 3.142-7 7-7 3.866 0 7 3.142 7 7 0 3.866-3.142 7-7 7-3.866 0-7-3.142-7-7z"/><path d="M1 7c0 3.309 2.69 6 6 6 3.309 0 6-2.69 6-6 0-3.309-2.69-6-6-6-3.309 0-6 2.69-6 6z" fill="#FFF"/><path d="M7 9.219a2.218 2.218 0 1 0 0-4.436A2.218 2.218 0 0 0 7 9.22zm0 1.12a3.338 3.338 0 1 1 0-6.676 3.338 3.338 0 0 1 0 6.676z"/></symbol><symbol viewBox="0 0 14 14" id="status_pending" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M4.7 5.3c0-.2.1-.3.3-.3h.9c.2 0 .3.1.3.3v3.4c0 .2-.1.3-.3.3H5c-.2 0-.3-.1-.3-.3V5.3m3 0c0-.2.1-.3.3-.3h.9c.2 0 .3.1.3.3v3.4c0 .2-.1.3-.3.3H8c-.2 0-.3-.1-.3-.3V5.3"/></g></symbol><symbol viewBox="0 0 22 22" id="status_pending_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M7.386 8.329c0-.315.157-.472.471-.472h1.414c.315 0 .472.157.472.472v5.342c0 .315-.157.472-.472.472H7.857c-.314 0-.471-.157-.471-.472V8.33m4.714 0c0-.315.157-.472.471-.472h1.415c.314 0 .471.157.471.472v5.342c0 .315-.157.472-.471.472H12.57c-.314 0-.471-.157-.471-.472V8.33"/></symbol><symbol viewBox="0 0 14 14" id="status_running" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M7 3c2.2 0 4 1.8 4 4s-1.8 4-4 4c-1.3 0-2.5-.7-3.3-1.7L7 7V3"/></g></symbol><symbol viewBox="0 0 22 22" id="status_running_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M11 4.714c3.457 0 6.286 2.829 6.286 6.286 0 3.457-2.829 6.286-6.286 6.286-2.043 0-3.929-1.1-5.186-2.672L11 11V4.714"/></symbol><symbol viewBox="0 0 14 14" id="status_skipped" xmlns="http://www.w3.org/2000/svg"><path d="M7 14A7 7 0 1 1 7 0a7 7 0 0 1 0 14z"/><path d="M7 13A6 6 0 1 0 7 1a6 6 0 0 0 0 12z" fill="#FFF"/><path d="M6.415 7.04L4.579 5.203a.295.295 0 0 1 .004-.416l.349-.349a.29.29 0 0 1 .416-.004l2.214 2.214a.289.289 0 0 1 .019.021l.132.133c.11.11.108.291 0 .398L5.341 9.573a.282.282 0 0 1-.398 0l-.331-.331a.285.285 0 0 1 0-.399L6.415 7.04zm2.54 0L7.119 5.203a.295.295 0 0 1 .004-.416l.349-.349a.29.29 0 0 1 .416-.004l2.214 2.214a.289.289 0 0 1 .019.021l.132.133c.11.11.108.291 0 .398L7.881 9.573a.282.282 0 0 1-.398 0l-.331-.331a.285.285 0 0 1 0-.399L8.955 7.04z"/></symbol><symbol viewBox="0 0 22 22" id="status_skipped_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M14.072 11.063l-2.82 2.82a.46.46 0 0 0-.001.652l.495.495a.457.457 0 0 0 .653-.001l3.7-3.7a.46.46 0 0 0 .001-.653l-.196-.196a.453.453 0 0 0-.03-.033l-3.479-3.479a.464.464 0 0 0-.654.007l-.548.548a.463.463 0 0 0-.007.654l2.886 2.886z"/><path d="M10.08 11.063l-2.819 2.82a.46.46 0 0 0-.002.652l.496.495a.457.457 0 0 0 .652-.001l3.7-3.7a.46.46 0 0 0 .002-.653l-.196-.196a.453.453 0 0 0-.03-.033l-3.48-3.479a.464.464 0 0 0-.653.007l-.548.548a.463.463 0 0 0-.007.654l2.886 2.886z"/></symbol><symbol viewBox="0 0 14 14" id="status_success" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M6.278 7.697L5.045 6.464a.296.296 0 0 0-.42-.002l-.613.614a.298.298 0 0 0 .002.42l1.91 1.909a.5.5 0 0 0 .703.005l.265-.265L9.997 6.04a.291.291 0 0 0-.009-.408l-.614-.614a.29.29 0 0 0-.408-.009L6.278 7.697z"/></g></symbol><symbol viewBox="0 0 22 22" id="status_success_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M9.866 12.095l-1.95-1.95a.462.462 0 0 0-.647.01l-.964.964a.46.46 0 0 0-.01.646l3.013 3.014a.787.787 0 0 0 1.106.008l.425-.425 4.854-4.853a.462.462 0 0 0 .002-.659l-.964-.964a.468.468 0 0 0-.658.002l-4.207 4.207z"/></symbol><symbol viewBox="0 0 14 14" id="status_success_solid" xmlns="http://www.w3.org/2000/svg"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7zm6.278.697L5.045 6.464a.296.296 0 0 0-.42-.002l-.613.614a.298.298 0 0 0 .002.42l1.91 1.909a.5.5 0 0 0 .703.005l.265-.265L9.997 6.04a.291.291 0 0 0-.009-.408l-.614-.614a.29.29 0 0 0-.408-.009L6.278 7.697z" fill-rule="evenodd"/></symbol><symbol viewBox="0 0 14 14" id="status_warning" xmlns="http://www.w3.org/2000/svg"><g fill-rule="evenodd"><path d="M0 7a7 7 0 1 1 14 0A7 7 0 0 1 0 7z"/><path d="M13 7A6 6 0 1 0 1 7a6 6 0 0 0 12 0z" fill="#FFF"/><path d="M6 3.5c0-.3.2-.5.5-.5h1c.3 0 .5.2.5.5v4c0 .3-.2.5-.5.5h-1c-.3 0-.5-.2-.5-.5v-4m0 6c0-.3.2-.5.5-.5h1c.3 0 .5.2.5.5v1c0 .3-.2.5-.5.5h-1c-.3 0-.5-.2-.5-.5v-1"/></g></symbol><symbol viewBox="0 0 22 22" id="status_warning_borderless" xmlns="http://www.w3.org/2000/svg"><path d="M9.429 5.5c0-.471.314-.786.785-.786h1.572c.471 0 .785.315.785.786v6.286c0 .471-.314.785-.785.785h-1.572c-.471 0-.785-.314-.785-.785V5.5m0 9.429c0-.472.314-.786.785-.786h1.572c.471 0 .785.314.785.786V16.5c0 .471-.314.786-.785.786h-1.572c-.471 0-.785-.315-.785-.786v-1.571"/></symbol><symbol viewBox="0 0 16 16" id="stop" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M2 0h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2V2a2 2 0 0 1 2-2z"/></symbol><symbol viewBox="0 0 16 16" id="talic" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M6 0h7a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2zm2 2h3L8 14H5L8 2zM3 14h7a1 1 0 0 1 0 2H3a1 1 0 0 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="task-done" xmlns="http://www.w3.org/2000/svg"><path d="M7.536 8.657l2.828-2.829a1 1 0 0 1 1.414 1.415l-3.535 3.535a.997.997 0 0 1-1.415 0l-2.12-2.121A1 1 0 0 1 6.12 7.243l1.415 1.414zM3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3z"/></symbol><symbol viewBox="0 0 16 16" id="template" xmlns="http://www.w3.org/2000/svg"><path d="M3 0h10a3 3 0 0 1 3 3v10a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V3a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V3a1 1 0 0 0-1-1H3zm.8 2h2.4a.8.8 0 0 1 .8.8v1.4a.8.8 0 0 1-.8.8H3.8a.8.8 0 0 1-.8-.8V4.8a.8.8 0 0 1 .8-.8zm4.7 0h4a.5.5 0 1 1 0 1h-4a.5.5 0 0 1 0-1zm0 2h4a.5.5 0 1 1 0 1h-4a.5.5 0 0 1 0-1zm-5 3h9a.5.5 0 1 1 0 1h-9a.5.5 0 0 1 0-1zm0 2h9a.5.5 0 1 1 0 1h-9a.5.5 0 1 1 0-1z"/></symbol><symbol viewBox="0 0 16 16" id="thump-down" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.33 11h5.282a2 2 0 0 0 1.963-2.38l-.563-2.905a3 3 0 0 0-.243-.732l-1.103-2.286A3 3 0 0 0 10.964 1H7a3 3 0 0 0-3 3v6.3a2 2 0 0 0 .436 1.247l3.11 3.9a.632.632 0 0 0 .941.053l.137-.137a1 1 0 0 0 .28-.87L8.329 11zM1 10h2V3H1a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1z"/></symbol><symbol viewBox="0 0 16 16" id="thump-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8.33 5h5.282a2 2 0 0 1 1.963 2.38l-.563 2.905a3 3 0 0 1-.243.732l-1.103 2.286A3 3 0 0 1 10.964 15H7a3 3 0 0 1-3-3V5.7a2 2 0 0 1 .436-1.247l3.11-3.9A.632.632 0 0 1 8.487.5l.137.137a1 1 0 0 1 .28.87L8.329 5zM1 6h2v7H1a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1z"/></symbol><symbol viewBox="0 0 16 16" id="timer" xmlns="http://www.w3.org/2000/svg"><path d="M12.022 3.27l.77-.77a1 1 0 0 1 1.415 1.414l-.728.729a7 7 0 1 1-1.456-1.372zM8 14A5 5 0 1 0 8 4a5 5 0 0 0 0 10zm0-9a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0V6a1 1 0 0 1 1-1zM6 0h4a1 1 0 0 1 0 2H6a1 1 0 1 1 0-2z"/></symbol><symbol viewBox="0 0 16 16" id="todo-add" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10 4V2a1 1 0 0 1 2 0v2h2a1 1 0 0 1 0 2h-2v2a1 1 0 0 1-2 0V6H8a1 1 0 1 1 0-2h2zm2 7a1 1 0 0 1 2 0v2a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h2a1 1 0 1 1 0 2H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-2z"/></symbol><symbol viewBox="0 0 16 16" id="todo-done" xmlns="http://www.w3.org/2000/svg"><path d="M8.243 7.485l4.95-4.95a1 1 0 1 1 1.414 1.415L8.95 9.607a.997.997 0 0 1-1.414 0L4.707 6.778a1 1 0 0 1 1.414-1.414l2.122 2.121zM12 11a1 1 0 0 1 2 0v2a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3h2a1 1 0 1 1 0 2H3a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1v-2z"/></symbol><symbol viewBox="0 0 16 16" id="token" xmlns="http://www.w3.org/2000/svg"><path d="M3 2h10a3 3 0 0 1 3 3v6a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V5a3 3 0 0 1 3-3zm0 2a1 1 0 0 0-1 1v6a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H3zm1 5a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2zm4 0a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="unapproval" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M11.95 8.536l1.06-1.061a1 1 0 0 1 1.415 1.414l-1.061 1.06 1.06 1.061a1 1 0 0 1-1.414 1.415l-1.06-1.061-1.06 1.06a1 1 0 1 1-1.415-1.414l1.06-1.06-1.06-1.06a1 1 0 0 1 1.414-1.415l1.06 1.06zm-3.768-.33c.006.503.201 1.006.586 1.39l.353.354-.353.353a2 2 0 1 0 2.828 2.829l.354-.354.047.048C11.964 14.363 11.527 15 6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8c.834 0 1.557.074 2.182.205zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6z"/></symbol><symbol viewBox="0 0 16 16" id="unassignee" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M11 5h4a1 1 0 0 1 0 2h-4a1 1 0 0 1 0-2zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="unlink" xmlns="http://www.w3.org/2000/svg"><path d="M11.295 8.845l-.659-1.664a1.78 1.78 0 0 0 .04-.04l1.415-1.414c.586-.586.654-1.468.152-1.97s-1.384-.434-1.97.152L8.859 5.323a1.781 1.781 0 0 0-.04.04l-1.664-.658c.141-.208.305-.408.491-.594l1.415-1.414c1.366-1.367 3.424-1.525 4.596-.354 1.171 1.172 1.013 3.23-.354 4.596L11.89 8.354c-.186.186-.386.35-.594.491zm-2.45 2.45a4.075 4.075 0 0 1-.491.594l-1.415 1.414c-1.366 1.367-3.424 1.525-4.596.354-1.171-1.172-1.013-3.23.354-4.596L4.11 7.646c.186-.186.386-.35.594-.491l.659 1.664a1.781 1.781 0 0 0-.04.04l-1.415 1.414c-.586.586-.654 1.468-.152 1.97s1.384.434 1.97-.152l1.414-1.414a1.78 1.78 0 0 0 .04-.04l1.664.658zm3.812-2.088h2a.5.5 0 0 1 .5.5v.05a.5.5 0 0 1-.5.5h-2a.5.5 0 0 1-.5-.5v-.05a.5.5 0 0 1 .5-.5zm-.384 2.116l1.415 1.414a.5.5 0 0 1 0 .708l-.037.036a.5.5 0 0 1-.707 0l-1.414-1.414a.5.5 0 0 1 0-.707l.036-.037a.5.5 0 0 1 .707 0zm-2.823 1.09a.5.5 0 0 1 .5-.5h.052a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5H9.95a.5.5 0 0 1-.5-.5v-2zm-2.748-9.16a.5.5 0 0 1-.5.5h-.05a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 1 .5-.5h.05a.5.5 0 0 1 .5.5v2zm-2.116.383a.5.5 0 0 1 0 .707l-.036.036a.5.5 0 0 1-.707 0L2.428 2.965a.5.5 0 0 1 0-.707l.037-.036a.5.5 0 0 1 .707 0l1.414 1.414zm-1.09 2.823h-2a.5.5 0 0 1-.5-.5v-.051a.5.5 0 0 1 .5-.5h2a.5.5 0 0 1 .5.5v.05a.5.5 0 0 1-.5.5z"/></symbol><symbol viewBox="0 0 16 16" id="user" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M8 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zm0 8c-6.888 0-6.976-.78-6.976-2.52S2.144 8 8 8s6.976 2.692 6.976 4.48c0 1.788-.088 2.52-6.976 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="users" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M10.521 8.01C15.103 8.19 16 10.755 16 12.48c0 1.533-.056 2.29-3.808 2.475.609-.54.808-1.331.808-2.475 0-1.911-.804-3.503-2.479-4.47zm-1.67-1.228A3.987 3.987 0 0 0 9.976 4a3.987 3.987 0 0 0-1.125-2.782 3 3 0 1 1 0 5.563zM5.976 7a3 3 0 1 1 0-6 3 3 0 0 1 0 6zM6 15c-5.924 0-6-.78-6-2.52S.964 8 6 8s6 2.692 6 4.48c0 1.788-.076 2.52-6 2.52z"/></symbol><symbol viewBox="0 0 16 16" id="volume-up" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M1 5h1v6H1a1 1 0 0 1-1-1V6a1 1 0 0 1 1-1zm2 0l4.445-2.964A1 1 0 0 1 9 2.87v10.26a1 1 0 0 1-1.555.833L3 11V5zm10.283 7.89a.5.5 0 0 1-.66-.752A5.485 5.485 0 0 0 14.5 8c0-1.601-.687-3.09-1.865-4.128a.5.5 0 0 1 .661-.75A6.484 6.484 0 0 1 15.5 8a6.485 6.485 0 0 1-2.217 4.89zm-2.002-2.236a.5.5 0 1 1-.652-.758c.55-.472.871-1.157.871-1.896 0-.732-.315-1.411-.856-1.883a.5.5 0 0 1 .658-.753A3.492 3.492 0 0 1 12.5 8c0 1.033-.45 1.994-1.219 2.654z"/></symbol><symbol viewBox="0 0 16 16" id="warning" xmlns="http://www.w3.org/2000/svg"><path d="M15.34 10.479A3 3 0 0 1 12.756 15h-9.51A3 3 0 0 1 .66 10.479l4.755-8.083a3 3 0 0 1 5.172 0l4.755 8.083zm-6.478-7.07a1 1 0 0 0-1.724 0l-4.755 8.084A1 1 0 0 0 3.245 13h9.51a1 1 0 0 0 .862-1.507L8.862 3.41zM8 5a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0V6a1 1 0 0 1 1-1zm0 7a1 1 0 1 1 0-2 1 1 0 0 1 0 2z"/></symbol><symbol viewBox="0 0 16 16" id="work" xmlns="http://www.w3.org/2000/svg"><path d="M12 3h1a3 3 0 0 1 3 3v7a3 3 0 0 1-3 3H3a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h1V2a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v1zM6 2v1h4V2H6zM3 5a1 1 0 0 0-1 1v7a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V6a1 1 0 0 0-1-1H3zm1.5 1a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5zm7 0a.5.5 0 0 1 .5.5v6a.5.5 0 1 1-1 0v-6a.5.5 0 0 1 .5-.5z"/></symbol></svg>
\ No newline at end of file
diff --git a/app/views/layouts/nav/breadcrumbs/_collapsed_dropdown.html.haml b/app/views/layouts/nav/breadcrumbs/_collapsed_dropdown.html.haml
index 610ff9001f7..ad0d51d28f9 100644
--- a/app/views/layouts/nav/breadcrumbs/_collapsed_dropdown.html.haml
+++ b/app/views/layouts/nav/breadcrumbs/_collapsed_dropdown.html.haml
@@ -4,7 +4,7 @@
   %li.dropdown
     %button.text-expander.has-tooltip.js-breadcrumbs-collapsed-expander{ type: "button", data: { toggle: "dropdown", container: "body" }, "aria-label": button_tooltip, title: button_tooltip }
       = icon("ellipsis-h")
-    = sprite_icon("angle-right", css_class: "breadcrumbs-list-angle")
+    = sprite_icon("angle-right", size: 8, css_class: "breadcrumbs-list-angle")
     .dropdown-menu
       %ul
         - @breadcrumb_dropdown_links[dropdown_location].each_with_index do |link, index|
diff --git a/yarn.lock b/yarn.lock
index ae86887630b..57644482b32 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2713,8 +2713,8 @@ getpass@^0.1.1:
     assert-plus "^1.0.0"
 
 "gitlab-svgs@https://gitlab.com/gitlab-org/gitlab-svgs.git":
-  version "1.0.2"
-  resolved "https://gitlab.com/gitlab-org/gitlab-svgs.git#e7621d7b028607ae9c69f8b496cd49b42fe607e4"
+  version "1.0.4"
+  resolved "https://gitlab.com/gitlab-org/gitlab-svgs.git#46c0a49cd43639948dfcc77a0f94d59deaad1e85"
 
 glob-base@^0.3.0:
   version "0.3.0"
-- 
cgit v1.2.1


From ccf31a13c5ff253256f5d904bf290c5285b2eeab Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 9 Oct 2017 07:45:51 +0000
Subject: Move cycle analytics banner into a vue file

---
 .../cycle_analytics/components/banner.vue          | 55 ++++++++++++++++++++++
 .../cycle_analytics/cycle_analytics_bundle.js      |  2 +
 app/views/projects/cycle_analytics/show.html.haml  | 15 ++----
 spec/javascripts/cycle_analytics/banner_spec.js    | 41 ++++++++++++++++
 4 files changed, 101 insertions(+), 12 deletions(-)
 create mode 100644 app/assets/javascripts/cycle_analytics/components/banner.vue
 create mode 100644 spec/javascripts/cycle_analytics/banner_spec.js

diff --git a/app/assets/javascripts/cycle_analytics/components/banner.vue b/app/assets/javascripts/cycle_analytics/components/banner.vue
new file mode 100644
index 00000000000..732697c134e
--- /dev/null
+++ b/app/assets/javascripts/cycle_analytics/components/banner.vue
@@ -0,0 +1,55 @@
+<script>
+  import iconCycleAnalyticsSplash from 'icons/_icon_cycle_analytics_splash.svg';
+
+  export default {
+    props: {
+      documentationLink: {
+        type: String,
+        required: true,
+      },
+    },
+    computed: {
+      iconCycleAnalyticsSplash() {
+        return iconCycleAnalyticsSplash;
+      },
+    },
+    methods: {
+      dismissOverviewDialog() {
+        this.$emit('dismiss-overview-dialog');
+      },
+    },
+  };
+</script>
+<template>
+  <div class="landing content-block">
+    <button
+      class="js-ca-dismiss-button dismiss-button"
+      type="button"
+      :aria-label="__('Dismiss Cycle Analytics introduction box')"
+      @click="dismissOverviewDialog">
+      <i
+        class="fa fa-times"
+        aria-hidden="true">
+      </i>
+    </button>
+    <div class="svg-container" v-html="iconCycleAnalyticsSplash">
+    </div>
+    <div class="inner-content">
+      <h4>
+        {{__('Introducing Cycle Analytics')}}
+      </h4>
+      <p>
+        {{ __('Cycle Analytics gives an overview of how much time it takes to go from idea to production in your project.') }}
+      </p>
+      <p>
+        <a
+          :href="documentationLink"
+          target="_blank"
+          rel="nofollow"
+          class="btn">
+          {{__('Read more')}}
+        </a>
+      </p>
+    </div>
+  </div>
+</template>
diff --git a/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js b/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
index 991fcf114da..cdf5e3c0290 100644
--- a/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
+++ b/app/assets/javascripts/cycle_analytics/cycle_analytics_bundle.js
@@ -3,6 +3,7 @@
 import Vue from 'vue';
 import Cookies from 'js-cookie';
 import Translate from '../vue_shared/translate';
+import banner from './components/banner.vue';
 import stageCodeComponent from './components/stage_code_component.vue';
 import stagePlanComponent from './components/stage_plan_component.vue';
 import stageComponent from './components/stage_component.vue';
@@ -44,6 +45,7 @@ $(() => {
       },
     },
     components: {
+      banner,
       'stage-issue-component': stageComponent,
       'stage-plan-component': stagePlanComponent,
       'stage-code-component': stageCodeComponent,
diff --git a/app/views/projects/cycle_analytics/show.html.haml b/app/views/projects/cycle_analytics/show.html.haml
index c06e9f323af..71d30da14a9 100644
--- a/app/views/projects/cycle_analytics/show.html.haml
+++ b/app/views/projects/cycle_analytics/show.html.haml
@@ -6,18 +6,9 @@
 
 #cycle-analytics{ class: container_class, "v-cloak" => "true", data: { request_path: project_cycle_analytics_path(@project) } }
   - if @cycle_analytics_no_data
-    .landing.content-block{ "v-if" => "!isOverviewDialogDismissed" }
-      %button.dismiss-button{ type: 'button', 'aria-label': 'Dismiss Cycle Analytics introduction box', "@click" => "dismissOverviewDialog()" }
-        = icon("times")
-      .svg-container
-        = custom_icon('icon_cycle_analytics_splash')
-      .inner-content
-        %h4
-          {{ __('Introducing Cycle Analytics') }}
-        %p
-          {{ __('Cycle Analytics gives an overview of how much time it takes to go from idea to production in your project.') }}
-        %p
-          = link_to _('Read more'), help_page_path('user/project/cycle_analytics'), target: '_blank', class: 'btn'
+    %banner{ "v-if" => "!isOverviewDialogDismissed",
+      "documentation-link": help_page_path('user/project/cycle_analytics'),
+      "v-on:dismiss-overview-dialog" => "dismissOverviewDialog()" }
   = icon("spinner spin", "v-show" => "isLoading")
   .wrapper{ "v-show" => "!isLoading && !hasError" }
     .panel.panel-default
diff --git a/spec/javascripts/cycle_analytics/banner_spec.js b/spec/javascripts/cycle_analytics/banner_spec.js
new file mode 100644
index 00000000000..fb6b7fee168
--- /dev/null
+++ b/spec/javascripts/cycle_analytics/banner_spec.js
@@ -0,0 +1,41 @@
+import Vue from 'vue';
+import banner from '~/cycle_analytics/components/banner.vue';
+import mountComponent from '../helpers/vue_mount_component_helper';
+
+describe('Cycle analytics banner', () => {
+  let vm;
+
+  beforeEach(() => {
+    const Component = Vue.extend(banner);
+    vm = mountComponent(Component, {
+      documentationLink: 'path',
+    });
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  it('should render cycle analytics information', () => {
+    expect(
+      vm.$el.querySelector('h4').textContent.trim(),
+    ).toEqual('Introducing Cycle Analytics');
+    expect(
+      vm.$el.querySelector('p').textContent.trim(),
+    ).toContain('Cycle Analytics gives an overview of how much time it takes to go from idea to production in your project.');
+    expect(
+      vm.$el.querySelector('a').textContent.trim(),
+    ).toEqual('Read more');
+    expect(
+      vm.$el.querySelector('a').getAttribute('href'),
+    ).toEqual('path');
+  });
+
+  it('should emit an event when close button is clicked', () => {
+    spyOn(vm, '$emit');
+
+    vm.$el.querySelector('.js-ca-dismiss-button').click();
+
+    expect(vm.$emit).toHaveBeenCalled();
+  });
+});
-- 
cgit v1.2.1


From 7b8148220c0c7ad17d24c9ddf1e669ee73f086bf Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 9 Oct 2017 09:04:13 +0000
Subject: Remove AjaxLoadingSpinner and CreateLabelDropdown from global
 namespace

---
 app/assets/javascripts/ajax_loading_spinner.js     |  5 +---
 .../boards/components/new_list_dropdown.js         | 21 ++++++++--------
 app/assets/javascripts/create_label.js             | 29 ++++++++++------------
 app/assets/javascripts/dispatcher.js               |  3 ++-
 app/assets/javascripts/labels_select.js            |  3 ++-
 app/assets/javascripts/main.js                     |  2 --
 spec/javascripts/ajax_loading_spinner_spec.js      |  4 +--
 7 files changed, 31 insertions(+), 36 deletions(-)

diff --git a/app/assets/javascripts/ajax_loading_spinner.js b/app/assets/javascripts/ajax_loading_spinner.js
index 8f5e2e545ec..2bc77859c26 100644
--- a/app/assets/javascripts/ajax_loading_spinner.js
+++ b/app/assets/javascripts/ajax_loading_spinner.js
@@ -1,4 +1,4 @@
-class AjaxLoadingSpinner {
+export default class AjaxLoadingSpinner {
   static init() {
     const $elements = $('.js-ajax-loading-spinner');
 
@@ -30,6 +30,3 @@ class AjaxLoadingSpinner {
     classList.toggle('fa-spin');
   }
 }
-
-window.gl = window.gl || {};
-gl.AjaxLoadingSpinner = AjaxLoadingSpinner;
diff --git a/app/assets/javascripts/boards/components/new_list_dropdown.js b/app/assets/javascripts/boards/components/new_list_dropdown.js
index d7f203b3f96..c19c989680d 100644
--- a/app/assets/javascripts/boards/components/new_list_dropdown.js
+++ b/app/assets/javascripts/boards/components/new_list_dropdown.js
@@ -1,6 +1,7 @@
-/* eslint-disable comma-dangle, func-names, no-new, space-before-function-paren, one-var,
+/* eslint-disable func-names, no-new, space-before-function-paren, one-var,
    promise/catch-or-return */
 import _ from 'underscore';
+import CreateLabelDropdown from '../../create_label';
 
 window.gl = window.gl || {};
 window.gl.issueBoards = window.gl.issueBoards || {};
@@ -15,15 +16,15 @@ $(document).off('created.label').on('created.label', (e, label) => {
     label: {
       id: label.id,
       title: label.title,
-      color: label.color
-    }
+      color: label.color,
+    },
   });
 });
 
 gl.issueBoards.newListDropdownInit = () => {
   $('.js-new-board-list').each(function () {
     const $this = $(this);
-    new gl.CreateLabelDropdown($this.closest('.dropdown').find('.dropdown-new-label'), $this.data('namespace-path'), $this.data('project-path'));
+    new CreateLabelDropdown($this.closest('.dropdown').find('.dropdown-new-label'), $this.data('namespace-path'), $this.data('project-path'));
 
     $this.glDropdown({
       data(term, callback) {
@@ -38,17 +39,17 @@ gl.issueBoards.newListDropdownInit = () => {
         const $a = $('<a />', {
           class: (active ? `is-active js-board-list-${active.id}` : ''),
           text: label.title,
-          href: '#'
+          href: '#',
         });
         const $labelColor = $('<span />', {
           class: 'dropdown-label-box',
-          style: `background-color: ${label.color}`
+          style: `background-color: ${label.color}`,
         });
 
         return $li.append($a.prepend($labelColor));
       },
       search: {
-        fields: ['title']
+        fields: ['title'],
       },
       filterable: true,
       selectable: true,
@@ -66,13 +67,13 @@ gl.issueBoards.newListDropdownInit = () => {
             label: {
               id: label.id,
               title: label.title,
-              color: label.color
-            }
+              color: label.color,
+            },
           });
 
           Store.state.lists = _.sortBy(Store.state.lists, 'position');
         }
-      }
+      },
     });
   });
 };
diff --git a/app/assets/javascripts/create_label.js b/app/assets/javascripts/create_label.js
index 907b468e576..3bed0678350 100644
--- a/app/assets/javascripts/create_label.js
+++ b/app/assets/javascripts/create_label.js
@@ -1,8 +1,8 @@
-/* eslint-disable func-names, space-before-function-paren, prefer-arrow-callback, comma-dangle, prefer-template, quotes, no-param-reassign, wrap-iife, max-len */
+/* eslint-disable func-names, prefer-arrow-callback */
 import Api from './api';
 
-class CreateLabelDropdown {
-  constructor ($el, namespacePath, projectPath) {
+export default class CreateLabelDropdown {
+  constructor($el, namespacePath, projectPath) {
     this.$el = $el;
     this.namespacePath = namespacePath;
     this.projectPath = projectPath;
@@ -22,7 +22,7 @@ class CreateLabelDropdown {
     this.addBinding();
   }
 
-  cleanBinding () {
+  cleanBinding() {
     this.$colorSuggestions.off('click');
     this.$newLabelField.off('keyup change');
     this.$newColorField.off('keyup change');
@@ -31,7 +31,7 @@ class CreateLabelDropdown {
     this.$newLabelCreateButton.off('click');
   }
 
-  addBinding () {
+  addBinding() {
     const self = this;
 
     this.$colorSuggestions.on('click', function (e) {
@@ -44,7 +44,7 @@ class CreateLabelDropdown {
 
     this.$dropdownBack.on('click', this.resetForm.bind(this));
 
-    this.$cancelButton.on('click', function(e) {
+    this.$cancelButton.on('click', function (e) {
       e.preventDefault();
       e.stopPropagation();
 
@@ -55,7 +55,7 @@ class CreateLabelDropdown {
     this.$newLabelCreateButton.on('click', this.saveLabel.bind(this));
   }
 
-  addColorValue (e, $this) {
+  addColorValue(e, $this) {
     e.preventDefault();
     e.stopPropagation();
 
@@ -66,7 +66,7 @@ class CreateLabelDropdown {
       .addClass('is-active');
   }
 
-  enableLabelCreateButton () {
+  enableLabelCreateButton() {
     if (this.$newLabelField.val() !== '' && this.$newColorField.val() !== '') {
       this.$newLabelError.hide();
       this.$newLabelCreateButton.enable();
@@ -75,7 +75,7 @@ class CreateLabelDropdown {
     }
   }
 
-  resetForm () {
+  resetForm() {
     this.$newLabelField
       .val('')
       .trigger('change');
@@ -90,13 +90,13 @@ class CreateLabelDropdown {
       .removeClass('is-active');
   }
 
-  saveLabel (e) {
+  saveLabel(e) {
     e.preventDefault();
     e.stopPropagation();
 
     Api.newLabel(this.namespacePath, this.projectPath, {
       title: this.$newLabelField.val(),
-      color: this.$newColorField.val()
+      color: this.$newColorField.val(),
     }, (label) => {
       this.$newLabelCreateButton.enable();
 
@@ -107,8 +107,8 @@ class CreateLabelDropdown {
           errors = label.message;
         } else {
           errors = Object.keys(label.message).map(key =>
-            `${gl.text.humanize(key)} ${label.message[key].join(', ')}`
-          ).join("<br/>");
+            `${gl.text.humanize(key)} ${label.message[key].join(', ')}`,
+          ).join('<br/>');
         }
 
         this.$newLabelError
@@ -122,6 +122,3 @@ class CreateLabelDropdown {
     });
   }
 }
-
-window.gl = window.gl || {};
-gl.CreateLabelDropdown = CreateLabelDropdown;
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index 33271c25146..6a4dce20f24 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -76,6 +76,7 @@ import GpgBadges from './gpg_badges';
 import UserFeatureHelper from './helpers/user_feature_helper';
 import initChangesDropdown from './init_changes_dropdown';
 import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
+import AjaxLoadingSpinner from './ajax_loading_spinner';
 
 (function() {
   var Dispatcher;
@@ -237,7 +238,7 @@ import { ajaxGet, convertPermissionToBoolean } from './lib/utils/common_utils';
           new NewBranchForm($('.js-create-branch-form'), JSON.parse(document.getElementById('availableRefs').innerHTML));
           break;
         case 'projects:branches:index':
-          gl.AjaxLoadingSpinner.init();
+          AjaxLoadingSpinner.init();
           new DeleteModal();
           break;
         case 'projects:issues:new':
diff --git a/app/assets/javascripts/labels_select.js b/app/assets/javascripts/labels_select.js
index 2538d9c2093..d479f7ed682 100644
--- a/app/assets/javascripts/labels_select.js
+++ b/app/assets/javascripts/labels_select.js
@@ -4,6 +4,7 @@
 import _ from 'underscore';
 import IssuableBulkUpdateActions from './issuable_bulk_update_actions';
 import DropdownUtils from './filtered_search/dropdown_utils';
+import CreateLabelDropdown from './create_label';
 
 (function() {
   this.LabelsSelect = (function() {
@@ -61,7 +62,7 @@ import DropdownUtils from './filtered_search/dropdown_utils';
         $sidebarLabelTooltip.tooltip();
 
         if ($dropdown.closest('.dropdown').find('.dropdown-new-label').length) {
-          new gl.CreateLabelDropdown($dropdown.closest('.dropdown').find('.dropdown-new-label'), namespacePath, projectPath);
+          new CreateLabelDropdown($dropdown.closest('.dropdown').find('.dropdown-new-label'), namespacePath, projectPath);
         }
 
         saveLabelData = function() {
diff --git a/app/assets/javascripts/main.js b/app/assets/javascripts/main.js
index 5858c2b6fd8..64d7c80e689 100644
--- a/app/assets/javascripts/main.js
+++ b/app/assets/javascripts/main.js
@@ -57,7 +57,6 @@ import './u2f/util';
 import './abuse_reports';
 import './activities';
 import './admin';
-import './ajax_loading_spinner';
 import './api';
 import './aside';
 import './autosave';
@@ -74,7 +73,6 @@ import './compare_autocomplete';
 import './confirm_danger_modal';
 import './copy_as_gfm';
 import './copy_to_clipboard';
-import './create_label';
 import './diff';
 import './dropzone_input';
 import './due_date_select';
diff --git a/spec/javascripts/ajax_loading_spinner_spec.js b/spec/javascripts/ajax_loading_spinner_spec.js
index 46e072a8ebb..c93b7cc6cac 100644
--- a/spec/javascripts/ajax_loading_spinner_spec.js
+++ b/spec/javascripts/ajax_loading_spinner_spec.js
@@ -1,6 +1,6 @@
 import 'jquery';
 import 'jquery-ujs';
-import '~/ajax_loading_spinner';
+import AjaxLoadingSpinner from '~/ajax_loading_spinner';
 
 describe('Ajax Loading Spinner', () => {
   const fixtureTemplate = 'static/ajax_loading_spinner.html.raw';
@@ -8,7 +8,7 @@ describe('Ajax Loading Spinner', () => {
 
   beforeEach(() => {
     loadFixtures(fixtureTemplate);
-    gl.AjaxLoadingSpinner.init();
+    AjaxLoadingSpinner.init();
   });
 
   it('change current icon with spinner icon and disable link while waiting ajax response', (done) => {
-- 
cgit v1.2.1


From 09dbbc27070cbd6151ec87fa82ae3c77c78492e1 Mon Sep 17 00:00:00 2001
From: Alexander <astrachan@gitlab.com>
Date: Mon, 9 Oct 2017 09:06:09 +0000
Subject: Resolve "Simple documentation update - backup to restore in restore
 section"

---
 doc/raketasks/backup_restore.md | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/doc/raketasks/backup_restore.md b/doc/raketasks/backup_restore.md
index ae69d7f92f2..e4c09b2b507 100644
--- a/doc/raketasks/backup_restore.md
+++ b/doc/raketasks/backup_restore.md
@@ -370,7 +370,7 @@ This is recommended to reduce cron spam.
 
 ## Restore
 
-GitLab provides a simple command line interface to backup your whole installation,
+GitLab provides a simple command line interface to restore your whole installation,
 and is flexible enough to fit your needs.
 
 The [restore prerequisites section](#restore-prerequisites) includes crucial
@@ -445,6 +445,14 @@ Restoring repositories:
 Deleting tmp directories...[DONE]
 ```
 
+Next, restore `/home/git/gitlab/.secret` if necessary as mentioned above.
+
+Restart GitLab:
+
+```shell
+sudo service gitlab restart
+```
+
 ### Restore for Omnibus installations
 
 This procedure assumes that:
@@ -480,10 +488,12 @@ restore:
 sudo gitlab-rake gitlab:backup:restore BACKUP=1493107454_2017_04_25_9.1.0
 ```
 
+Next, restore `/etc/gitlab/gitlab-secrets.json` if necessary as mentioned above.
+
 Restart and check GitLab:
 
 ```shell
-sudo gitlab-ctl start
+sudo gitlab-ctl restart
 sudo gitlab-rake gitlab:check SANITIZE=true
 ```
 
-- 
cgit v1.2.1


From 75212feefd3e8fba3e59e7c070c6dd0d7d2dd96e Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Mon, 9 Oct 2017 11:28:01 +0200
Subject: Move i18n/introduction to i18n/index

---
 doc/development/README.md            |  4 +-
 doc/development/i18n/index.md        | 74 ++++++++++++++++++++++++++++++++++++
 doc/development/i18n/introduction.md | 74 ------------------------------------
 3 files changed, 76 insertions(+), 76 deletions(-)
 create mode 100644 doc/development/i18n/index.md
 delete mode 100644 doc/development/i18n/introduction.md

diff --git a/doc/development/README.md b/doc/development/README.md
index a976da5dbd4..b648c7ce086 100644
--- a/doc/development/README.md
+++ b/doc/development/README.md
@@ -64,9 +64,9 @@
 - [Hash Indexes](hash_indexes.md)
 - [Swapping Tables](swapping_tables.md)
 
-## i18n
+## Internationalization (i18n)
 
-- [Introduction](i18n/introduction.md)
+- [Introduction](i18n/index.md)
 - [Externalization](i18n/externalization.md)
 - [Translation](i18n/translation.md)
 
diff --git a/doc/development/i18n/index.md b/doc/development/i18n/index.md
new file mode 100644
index 00000000000..e8182ace9c3
--- /dev/null
+++ b/doc/development/i18n/index.md
@@ -0,0 +1,74 @@
+# Translate GitLab to your language
+
+The text in GitLab's user interface is in American English by default.
+Each string can be translated to other languages.
+As each string is translated, it is added to the languages translation file,
+and will be available in future releases of GitLab.
+
+Contributions to translations are always needed.
+Many strings are not yet available for translation because they have not been externalized.
+Helping externalize strings benefits all languages.
+Some translations are incomplete or inconsistent.
+Translating strings will help complete and improve each language.
+
+## How to contribute
+
+### Externalize strings
+
+Before a string can be translated, it must be externalized.
+This is the process where English strings in the GitLab source code are wrapped in a function that
+retrieves the translated string for the user's language.
+
+As new features are added and existing features are updated, the surrounding strings are being
+externalized, however, there are many parts of GitLab that still need more work to externalize all
+strings.
+
+See [Externalization for GitLab](externalization.md).
+
+### Translate strings
+
+The translation process is managed at [translate.gitlab.com](https://translate.gitlab.com)
+using [Crowdin](https://crowdin.com/).
+You will need to create an account before you can submit translations.
+Once you are signed in, select the language you wish to contribute translations to.
+
+Voting for translations is also valuable, helping to confirm good and flag inaccurate translations.
+
+See [Translation guidelines](translation.md).
+
+### Proof reading
+
+Proof reading helps ensure the accuracy and consistency of translations.
+All translations are proof read before being accepted.
+If a translations requires changes, you will be notified with a comment explaining why.
+
+Community assistance proof reading translations is encouraged and appreciated.
+Requests to become a proof reader will be considered on the merits of previous translations.
+
+- Bulgarian
+- Chinese Simplified
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Chinese Traditional
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Chinese Traditional, Hong Kong
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Dutch
+- Esperanto
+- French
+- German
+- Italian
+- Japanese
+- Korean
+  - [Huang Tao](https://crowdin.com/profile/htve)
+- Portuguese, Brazilian
+- Russian
+  - [Alexy Lustin](https://crowdin.com/profile/lustin)
+  - [Nikita Grylov](https://crowdin.com/profile/nixel2007)
+- Spanish
+- Ukrainian
+
+If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
+
+### Release
+
+Translations are typically included in the next major or minor release.
diff --git a/doc/development/i18n/introduction.md b/doc/development/i18n/introduction.md
deleted file mode 100644
index e8182ace9c3..00000000000
--- a/doc/development/i18n/introduction.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# Translate GitLab to your language
-
-The text in GitLab's user interface is in American English by default.
-Each string can be translated to other languages.
-As each string is translated, it is added to the languages translation file,
-and will be available in future releases of GitLab.
-
-Contributions to translations are always needed.
-Many strings are not yet available for translation because they have not been externalized.
-Helping externalize strings benefits all languages.
-Some translations are incomplete or inconsistent.
-Translating strings will help complete and improve each language.
-
-## How to contribute
-
-### Externalize strings
-
-Before a string can be translated, it must be externalized.
-This is the process where English strings in the GitLab source code are wrapped in a function that
-retrieves the translated string for the user's language.
-
-As new features are added and existing features are updated, the surrounding strings are being
-externalized, however, there are many parts of GitLab that still need more work to externalize all
-strings.
-
-See [Externalization for GitLab](externalization.md).
-
-### Translate strings
-
-The translation process is managed at [translate.gitlab.com](https://translate.gitlab.com)
-using [Crowdin](https://crowdin.com/).
-You will need to create an account before you can submit translations.
-Once you are signed in, select the language you wish to contribute translations to.
-
-Voting for translations is also valuable, helping to confirm good and flag inaccurate translations.
-
-See [Translation guidelines](translation.md).
-
-### Proof reading
-
-Proof reading helps ensure the accuracy and consistency of translations.
-All translations are proof read before being accepted.
-If a translations requires changes, you will be notified with a comment explaining why.
-
-Community assistance proof reading translations is encouraged and appreciated.
-Requests to become a proof reader will be considered on the merits of previous translations.
-
-- Bulgarian
-- Chinese Simplified
-  - [Huang Tao](https://crowdin.com/profile/htve)
-- Chinese Traditional
-  - [Huang Tao](https://crowdin.com/profile/htve)
-- Chinese Traditional, Hong Kong
-  - [Huang Tao](https://crowdin.com/profile/htve)
-- Dutch
-- Esperanto
-- French
-- German
-- Italian
-- Japanese
-- Korean
-  - [Huang Tao](https://crowdin.com/profile/htve)
-- Portuguese, Brazilian
-- Russian
-  - [Alexy Lustin](https://crowdin.com/profile/lustin)
-  - [Nikita Grylov](https://crowdin.com/profile/nixel2007)
-- Spanish
-- Ukrainian
-
-If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
-
-### Release
-
-Translations are typically included in the next major or minor release.
-- 
cgit v1.2.1


From 5a25fc1ed80ef913b9abd30c7decdbcd2dab6676 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Mon, 9 Oct 2017 11:36:07 +0200
Subject: Update i18n docs

---
 doc/development/i18n/externalization.md | 17 ++++++++---------
 doc/development/i18n/index.md           |  4 +++-
 doc/development/i18n/translation.md     |  4 ++++
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/doc/development/i18n/externalization.md b/doc/development/i18n/externalization.md
index bd0ef39ca62..167260b6e0e 100644
--- a/doc/development/i18n/externalization.md
+++ b/doc/development/i18n/externalization.md
@@ -2,22 +2,21 @@
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10669) in GitLab 9.2.
 
-For working with internationalization (i18n) we use
-[GNU gettext](https://www.gnu.org/software/gettext/) given it's the most used
-tool for this task and we have a lot of applications that will help us to work
-with it.
+For working with internationalization (i18n),
+[GNU gettext](https://www.gnu.org/software/gettext/) is used given it's the most
+used tool for this task and there are a lot of applications that will help us to
+work with it.
 
 ## Setting up GitLab Development Kit (GDK)
 
-In order to be able to work on the [GitLab Community Edition](https://gitlab.com/gitlab-org/gitlab-ce) project we must download and
-configure it through [GDK](https://gitlab.com/gitlab-org/gitlab-development-kit), we can do it by following this [guide](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/set-up-gdk.md).
+In order to be able to work on the [GitLab Community Edition](https://gitlab.com/gitlab-org/gitlab-ce)
+project you must download and configure it through [GDK](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/master/doc/set-up-gdk.md).
 
-Once we have the GitLab project ready we can start working on the
-translation of the project.
+Once you have the GitLab project ready, you can start working on the translation.
 
 ## Tools
 
-We use a couple of gems:
+The following tools are used:
 
 1. [`gettext_i18n_rails`](https://github.com/grosser/gettext_i18n_rails): this
    gem allow us to translate content from models, views and controllers. Also
diff --git a/doc/development/i18n/index.md b/doc/development/i18n/index.md
index e8182ace9c3..4cb2624c098 100644
--- a/doc/development/i18n/index.md
+++ b/doc/development/i18n/index.md
@@ -13,6 +13,8 @@ Translating strings will help complete and improve each language.
 
 ## How to contribute
 
+There are many ways you can contribute in translating GitLab.
+
 ### Externalize strings
 
 Before a string can be translated, it must be externalized.
@@ -69,6 +71,6 @@ Requests to become a proof reader will be considered on the merits of previous t
 
 If you would like to be added as a proof reader, please [open an issue](https://gitlab.com/gitlab-org/gitlab-ce/issues).
 
-### Release
+## Release
 
 Translations are typically included in the next major or minor release.
diff --git a/doc/development/i18n/translation.md b/doc/development/i18n/translation.md
index 8687e47ee1c..79707aaf671 100644
--- a/doc/development/i18n/translation.md
+++ b/doc/development/i18n/translation.md
@@ -4,6 +4,8 @@ For managing the translation process we use [Crowdin](https://crowdin.com).
 
 ## Using Crowdin
 
+The first step is to get familiar with Crowdin.
+
 ### Sign In
 
 To contribute translations at [translate.gitlab.com](https://translate.gitlab.com)
@@ -37,6 +39,8 @@ Remember to **Save** each translation.
 
 ## Translation Guidelines
 
+Be sure to check the following guidelines before you translate any strings.
+
 ### Technical terms
 
 Technical terms should be treated like proper nouns and not be translated.
-- 
cgit v1.2.1


From 0e9c88625b2daa3d4699ab590cd1e19c06254456 Mon Sep 17 00:00:00 2001
From: Achilleas Pipinellis <axil@gitlab.com>
Date: Mon, 9 Oct 2017 11:39:13 +0200
Subject: Fix link to new i18n index page

---
 doc/development/i18n_guide.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/development/i18n_guide.md b/doc/development/i18n_guide.md
index 6eeffcc0f35..f6e949b5fd8 100644
--- a/doc/development/i18n_guide.md
+++ b/doc/development/i18n_guide.md
@@ -1 +1 @@
-This document was moved to [a new location](externalization.md).
+This document was moved to [a new location](i18n/index.md).
-- 
cgit v1.2.1


From 2597d8d2e0956644619acbac61343635cb7bd459 Mon Sep 17 00:00:00 2001
From: Filipa Lacerda <filipa@gitlab.com>
Date: Mon, 9 Oct 2017 10:46:40 +0000
Subject: Removes CommitsList from global namespace

---
 app/assets/javascripts/commits.js    |  51 +++++++++--------
 app/assets/javascripts/dispatcher.js |   2 +-
 spec/javascripts/commits_spec.js     | 108 +++++++++++++++++------------------
 3 files changed, 79 insertions(+), 82 deletions(-)

diff --git a/app/assets/javascripts/commits.js b/app/assets/javascripts/commits.js
index 047544b1762..ae6b8902032 100644
--- a/app/assets/javascripts/commits.js
+++ b/app/assets/javascripts/commits.js
@@ -1,17 +1,19 @@
-/* eslint-disable func-names, space-before-function-paren, wrap-iife, quotes, consistent-return, no-return-assign, no-param-reassign, one-var, no-var, one-var-declaration-per-line, no-unused-vars, prefer-template, object-shorthand, comma-dangle, max-len, prefer-arrow-callback */
+/* eslint-disable func-names, wrap-iife, consistent-return,
+  no-return-assign, no-param-reassign, one-var-declaration-per-line, no-unused-vars,
+  prefer-template, object-shorthand, prefer-arrow-callback */
 /* global Pager */
 
-window.CommitsList = (function() {
-  var CommitsList = {};
+export default (function () {
+  const CommitsList = {};
 
   CommitsList.timer = null;
 
-  CommitsList.init = function(limit) {
+  CommitsList.init = function (limit) {
     this.$contentList = $('.content_list');
 
-    $("body").on("click", ".day-commits-table li.commit", function(e) {
-      if (e.target.nodeName !== "A") {
-        location.href = $(this).attr("url");
+    $('body').on('click', '.day-commits-table li.commit', function (e) {
+      if (e.target.nodeName !== 'A') {
+        location.href = $(this).attr('url');
         e.stopPropagation();
         return false;
       }
@@ -19,48 +21,47 @@ window.CommitsList = (function() {
 
     Pager.init(parseInt(limit, 10), false, false, this.processCommits);
 
-    this.content = $("#commits-list");
-    this.searchField = $("#commits-search");
+    this.content = $('#commits-list');
+    this.searchField = $('#commits-search');
     this.lastSearch = this.searchField.val();
     return this.initSearch();
   };
 
-  CommitsList.initSearch = function() {
+  CommitsList.initSearch = function () {
     this.timer = null;
-    return this.searchField.keyup((function(_this) {
-      return function() {
+    return this.searchField.keyup((function (_this) {
+      return function () {
         clearTimeout(_this.timer);
         return _this.timer = setTimeout(_this.filterResults, 500);
       };
     })(this));
   };
 
-  CommitsList.filterResults = function() {
-    var commitsUrl, form, search;
-    form = $(".commits-search-form");
-    search = CommitsList.searchField.val();
+  CommitsList.filterResults = function () {
+    const form = $('.commits-search-form');
+    const search = CommitsList.searchField.val();
     if (search === CommitsList.lastSearch) return;
-    commitsUrl = form.attr("action") + '?' + form.serialize();
+    const commitsUrl = form.attr('action') + '?' + form.serialize();
     CommitsList.content.fadeTo('fast', 0.5);
     return $.ajax({
-      type: "GET",
-      url: form.attr("action"),
+      type: 'GET',
+      url: form.attr('action'),
       data: form.serialize(),
-      complete: function() {
+      complete: function () {
         return CommitsList.content.fadeTo('fast', 1.0);
       },
-      success: function(data) {
+      success: function (data) {
         CommitsList.lastSearch = search;
         CommitsList.content.html(data.html);
         return history.replaceState({
-          page: commitsUrl
+          page: commitsUrl,
         // Change url so if user reload a page - search results are saved
         }, document.title, commitsUrl);
       },
-      error: function() {
+      error: function () {
         CommitsList.lastSearch = null;
       },
-      dataType: "json"
+      dataType: 'json',
     });
   };
 
@@ -81,7 +82,7 @@ window.CommitsList = (function() {
       commitsCount = $commitsHeadersLast.nextUntil('li.js-commit-header').find('li.commit').length;
 
       // Remove duplicate of commits header.
-      processedData = $processedData.not(`li.js-commit-header[data-day="${loadedShownDayFirst}"]`);
+      processedData = $processedData.not(`li.js-commit-header[data-day='${loadedShownDayFirst}']`);
 
       // Update commits count in the previous commits header.
       commitsCount += Number($(processedData).nextUntil('li.js-commit-header').first().find('li.commit').length);
diff --git a/app/assets/javascripts/dispatcher.js b/app/assets/javascripts/dispatcher.js
index c3349c382ad..1edd460f380 100644
--- a/app/assets/javascripts/dispatcher.js
+++ b/app/assets/javascripts/dispatcher.js
@@ -7,7 +7,6 @@
 /* global IssuableForm */
 /* global LabelsSelect */
 /* global MilestoneSelect */
-/* global CommitsList */
 /* global NewBranchForm */
 /* global NotificationsForm */
 /* global NotificationsDropdown */
@@ -35,6 +34,7 @@
 /* global Sidebar */
 /* global ShortcutsWiki */
 
+import CommitsList from './commits';
 import Issue from './issue';
 import BindInOut from './behaviors/bind_in_out';
 import DeleteModal from './branches/branches_delete_modal';
diff --git a/spec/javascripts/commits_spec.js b/spec/javascripts/commits_spec.js
index ace95000468..e5a5e3293b9 100644
--- a/spec/javascripts/commits_spec.js
+++ b/spec/javascripts/commits_spec.js
@@ -1,77 +1,73 @@
-/* global CommitsList */
-
 import 'vendor/jquery.endless-scroll';
 import '~/pager';
-import '~/commits';
-
-(() => {
-  describe('Commits List', () => {
-    beforeEach(() => {
-      setFixtures(`
-        <form class="commits-search-form" action="/h5bp/html5-boilerplate/commits/master">
-          <input id="commits-search">
-        </form>
-        <ol id="commits-list"></ol>
-        `);
-    });
+import CommitsList from '~/commits';
 
-    it('should be defined', () => {
-      expect(CommitsList).toBeDefined();
-    });
+describe('Commits List', () => {
+  beforeEach(() => {
+    setFixtures(`
+      <form class="commits-search-form" action="/h5bp/html5-boilerplate/commits/master">
+        <input id="commits-search">
+      </form>
+      <ol id="commits-list"></ol>
+      `);
+  });
 
-    describe('processCommits', () => {
-      it('should join commit headers', () => {
-        CommitsList.$contentList = $(`
-          <div>
-            <li class="commit-header" data-day="2016-09-20">
-              <span class="day">20 Sep, 2016</span>
-              <span class="commits-count">1 commit</span>
-            </li>
-            <li class="commit"></li>
-          </div>
-        `);
+  it('should be defined', () => {
+    expect(CommitsList).toBeDefined();
+  });
 
-        const data = `
+  describe('processCommits', () => {
+    it('should join commit headers', () => {
+      CommitsList.$contentList = $(`
+        <div>
           <li class="commit-header" data-day="2016-09-20">
             <span class="day">20 Sep, 2016</span>
             <span class="commits-count">1 commit</span>
           </li>
           <li class="commit"></li>
-        `;
+        </div>
+      `);
 
-        // The last commit header should be removed
-        // since the previous one has the same data-day value.
-        expect(CommitsList.processCommits(data).find('li.commit-header').length).toBe(0);
-      });
+      const data = `
+        <li class="commit-header" data-day="2016-09-20">
+          <span class="day">20 Sep, 2016</span>
+          <span class="commits-count">1 commit</span>
+        </li>
+        <li class="commit"></li>
+      `;
+
+      // The last commit header should be removed
+      // since the previous one has the same data-day value.
+      expect(CommitsList.processCommits(data).find('li.commit-header').length).toBe(0);
     });
+  });
 
-    describe('on entering input', () => {
-      let ajaxSpy;
+  describe('on entering input', () => {
+    let ajaxSpy;
 
-      beforeEach(() => {
-        CommitsList.init(25);
-        CommitsList.searchField.val('');
+    beforeEach(() => {
+      CommitsList.init(25);
+      CommitsList.searchField.val('');
 
-        spyOn(history, 'replaceState').and.stub();
-        ajaxSpy = spyOn(jQuery, 'ajax').and.callFake((req) => {
-          req.success({
-            data: '<li>Result</li>',
-          });
+      spyOn(history, 'replaceState').and.stub();
+      ajaxSpy = spyOn(jQuery, 'ajax').and.callFake((req) => {
+        req.success({
+          data: '<li>Result</li>',
         });
       });
+    });
 
-      it('should save the last search string', () => {
-        CommitsList.searchField.val('GitLab');
-        CommitsList.filterResults();
-        expect(ajaxSpy).toHaveBeenCalled();
-        expect(CommitsList.lastSearch).toEqual('GitLab');
-      });
+    it('should save the last search string', () => {
+      CommitsList.searchField.val('GitLab');
+      CommitsList.filterResults();
+      expect(ajaxSpy).toHaveBeenCalled();
+      expect(CommitsList.lastSearch).toEqual('GitLab');
+    });
 
-      it('should not make ajax call if the input does not change', () => {
-        CommitsList.filterResults();
-        expect(ajaxSpy).not.toHaveBeenCalled();
-        expect(CommitsList.lastSearch).toEqual('');
-      });
+    it('should not make ajax call if the input does not change', () => {
+      CommitsList.filterResults();
+      expect(ajaxSpy).not.toHaveBeenCalled();
+      expect(CommitsList.lastSearch).toEqual('');
     });
   });
-})();
+});
-- 
cgit v1.2.1