Merge commit '7e424eb852716495073881710e8a8851b4a4cd5a' into object-storage-ee-to-ce-backport

1 files changed, 20 insertions, 1 deletions

diff --git a/lib/api/users.rb b/lib/api/users.rb
index e5de31ad51b..3cc12724b8a 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -18,6 +18,14 @@ module API
           User.find_by(id: id) || not_found!('User')
         end
 
+        def reorder_users(users)
+          if params[:order_by] && params[:sort]
+            users.reorder(params[:order_by] => params[:sort])
+          else
+            users
+          end
+        end
+
         params :optional_attributes do
           optional :skype, type: String, desc: 'The Skype username'
           optional :linkedin, type: String, desc: 'The LinkedIn username'
@@ -35,6 +43,13 @@ module API
           optional :avatar, type: File, desc: 'Avatar image for user'
           all_or_none_of :extern_uid, :provider
         end
+
+        params :sort_params do
+          optional :order_by, type: String, values: %w[id name username created_at updated_at],
+                              default: 'id', desc: 'Return users ordered by a field'
+          optional :sort, type: String, values: %w[asc desc], default: 'desc',
+                          desc: 'Return users sorted in ascending and descending order'
+        end
       end
 
       desc 'Get the list of users' do
@@ -53,16 +68,18 @@ module API
         optional :created_before, type: DateTime, desc: 'Return users created before the specified time'
         all_or_none_of :extern_uid, :provider
 
+        use :sort_params
         use :pagination
       end
       get do
         authenticated_as_admin! if params[:external].present? || (params[:extern_uid].present? && params[:provider].present?)
 
         unless current_user&.admin?
-          params.except!(:created_after, :created_before)
+          params.except!(:created_after, :created_before, :order_by, :sort)
         end
 
         users = UsersFinder.new(current_user, params).execute
+        users = reorder_users(users)
 
         authorized = can?(current_user, :read_users_list)
 
@@ -383,6 +400,8 @@ module API
         optional :hard_delete, type: Boolean, desc: "Whether to remove a user's contributions"
       end
       delete ":id" do
+        Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42279')
+
         authenticated_as_admin!
 
         user = User.find_by(id: params[:id])