Merge branch 'maintainers-can-create-subgroup' of https://gitlab.com/fapapa/gitlab-ce into maintainers-can-create-subgroup

11 files changed, 233 insertions, 19 deletions

diff --git a/lib/api/api.rb b/lib/api/api.rb
index 42499c5b41e..574934d7f90 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -111,6 +111,7 @@ module API
     mount ::API::Features
     mount ::API::Files
     mount ::API::GroupBoards
+    mount ::API::GroupClusters
     mount ::API::GroupLabels
     mount ::API::GroupMilestones
     mount ::API::Groups
@@ -166,6 +167,7 @@ module API
     mount ::API::Templates
     mount ::API::Todos
     mount ::API::Triggers
+    mount ::API::UserCounts
     mount ::API::Users
     mount ::API::Variables
     mount ::API::Version
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index b9aa387ba61..0a9515f1dd2 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -201,6 +201,7 @@ module API
         # MR describing the solution: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20555
         projects_relation.preload(:project_feature, :route)
                          .preload(:import_state, :tags)
+                         .preload(:auto_devops)
                          .preload(namespace: [:route, :owner])
       end
       # rubocop: enable CodeReuse/ActiveRecord
@@ -247,12 +248,20 @@ module API
       expose :container_registry_enabled
 
       # Expose old field names with the new permissions methods to keep API compatible
+      # TODO: remove in API v5, replaced by *_access_level
       expose(:issues_enabled) { |project, options| project.feature_available?(:issues, options[:current_user]) }
       expose(:merge_requests_enabled) { |project, options| project.feature_available?(:merge_requests, options[:current_user]) }
       expose(:wiki_enabled) { |project, options| project.feature_available?(:wiki, options[:current_user]) }
       expose(:jobs_enabled) { |project, options| project.feature_available?(:builds, options[:current_user]) }
       expose(:snippets_enabled) { |project, options| project.feature_available?(:snippets, options[:current_user]) }
 
+      expose(:issues_access_level) { |project, options| project.project_feature.string_access_level(:issues) }
+      expose(:repository_access_level) { |project, options| project.project_feature.string_access_level(:repository) }
+      expose(:merge_requests_access_level) { |project, options| project.project_feature.string_access_level(:merge_requests) }
+      expose(:wiki_access_level) { |project, options| project.project_feature.string_access_level(:wiki) }
+      expose(:builds_access_level) { |project, options| project.project_feature.string_access_level(:builds) }
+      expose(:snippets_access_level) { |project, options| project.project_feature.string_access_level(:snippets) }
+
       expose :shared_runners_enabled
       expose :lfs_enabled?, as: :lfs_enabled
       expose :creator_id
@@ -267,6 +276,12 @@ module API
       expose :runners_token, if: lambda { |_project, options| options[:user_can_admin_project] }
       expose :ci_default_git_depth
       expose :public_builds, as: :public_jobs
+      expose :build_git_strategy, if: lambda { |project, options| options[:user_can_admin_project] } do |project, options|
+        project.build_allow_git_fetch ? 'fetch' : 'clone'
+      end
+      expose :build_timeout
+      expose :auto_cancel_pending_pipelines
+      expose :build_coverage_regex
       expose :ci_config_path, if: -> (project, options) { Ability.allowed?(options[:current_user], :download_code, project) }
       expose :shared_with_groups do |project, options|
         SharedGroup.represent(project.project_group_links, options)
@@ -280,6 +295,10 @@ module API
         options[:statistics] && Ability.allowed?(options[:current_user], :read_statistics, project)
       }
       expose :external_authorization_classification_label
+      expose :auto_devops_enabled?, as: :auto_devops_enabled
+      expose :auto_devops_deploy_strategy do |project, options|
+        project.auto_devops.nil? ? 'continuous' : project.auto_devops.deploy_strategy
+      end
 
       # rubocop: disable CodeReuse/ActiveRecord
       def self.preload_relation(projects_relation, options = {})
@@ -289,6 +308,7 @@ module API
         # MR describing the solution: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20555
         super(projects_relation).preload(:group)
                                 .preload(:ci_cd_settings)
+                                .preload(:auto_devops)
                                 .preload(project_group_links: { group: :route },
                                          fork_network: :root_project,
                                          fork_network_member: :forked_from_project,
@@ -491,7 +511,7 @@ module API
       end
     end
 
-    class ProjectEntity < Grape::Entity
+    class IssuableEntity < Grape::Entity
       expose :id, :iid
       expose(:project_id) { |entity| entity&.project.try(:id) }
       expose :title, :description
@@ -544,7 +564,7 @@ module API
       end
     end
 
-    class IssueBasic < ProjectEntity
+    class IssueBasic < IssuableEntity
       expose :closed_at
       expose :closed_by, using: Entities::UserBasic
 
@@ -650,14 +670,14 @@ module API
       end
     end
 
-    class MergeRequestSimple < ProjectEntity
+    class MergeRequestSimple < IssuableEntity
       expose :title
       expose :web_url do |merge_request, options|
         Gitlab::UrlBuilder.build(merge_request)
       end
     end
 
-    class MergeRequestBasic < ProjectEntity
+    class MergeRequestBasic < IssuableEntity
       expose :merged_by, using: Entities::UserBasic do |merge_request, _options|
         merge_request.metrics&.merged_by
       end
@@ -1666,5 +1686,9 @@ module API
     class ClusterProject < Cluster
       expose :project, using: Entities::BasicProjectDetails
     end
+
+    class ClusterGroup < Cluster
+      expose :group, using: Entities::BasicGroupDetails
+    end
   end
 end
diff --git a/lib/api/group_clusters.rb b/lib/api/group_clusters.rb
new file mode 100644
index 00000000000..db0f8081140
--- /dev/null
+++ b/lib/api/group_clusters.rb
@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module API
+  class GroupClusters < Grape::API
+    include PaginationParams
+
+    before { authenticate! }
+
+    # EE::API::GroupClusters will
+    # override these methods
+    helpers do
+      params :create_params_ee do
+      end
+
+      params :update_params_ee do
+      end
+    end
+
+    params do
+      requires :id, type: String, desc: 'The ID of the group'
+    end
+    resource :groups, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
+      desc 'Get all clusters from the group' do
+        success Entities::Cluster
+      end
+      params do
+        use :pagination
+      end
+      get ':id/clusters' do
+        authorize! :read_cluster, user_group
+
+        present paginate(clusters_for_current_user), with: Entities::Cluster
+      end
+
+      desc 'Get specific cluster for the group' do
+        success Entities::ClusterGroup
+      end
+      params do
+        requires :cluster_id, type: Integer, desc: 'The cluster ID'
+      end
+      get ':id/clusters/:cluster_id' do
+        authorize! :read_cluster, cluster
+
+        present cluster, with: Entities::ClusterGroup
+      end
+
+      desc 'Adds an existing cluster' do
+        success Entities::ClusterGroup
+      end
+      params do
+        requires :name, type: String, desc: 'Cluster name'
+        optional :enabled, type: Boolean, default: true, desc: 'Determines if cluster is active or not, defaults to true'
+        optional :domain, type: String, desc: 'Cluster base domain'
+        optional :managed, type: Boolean, default: true, desc: 'Determines if GitLab will manage namespaces and service accounts for this cluster, defaults to true'
+        requires :platform_kubernetes_attributes, type: Hash, desc: %q(Platform Kubernetes data) do
+          requires :api_url, type: String, allow_blank: false, desc: 'URL to access the Kubernetes API'
+          requires :token, type: String, desc: 'Token to authenticate against Kubernetes'
+          optional :ca_cert, type: String, desc: 'TLS certificate (needed if API is using a self-signed TLS certificate)'
+          optional :namespace, type: String, desc: 'Unique namespace related to Group'
+          optional :authorization_type, type: String, values: Clusters::Platforms::Kubernetes.authorization_types.keys, default: 'rbac', desc: 'Cluster authorization type, defaults to RBAC'
+        end
+        use :create_params_ee
+      end
+      post ':id/clusters/user' do
+        authorize! :add_cluster, user_group
+
+        user_cluster = ::Clusters::CreateService
+          .new(current_user, create_cluster_user_params)
+          .execute
+
+        if user_cluster.persisted?
+          present user_cluster, with: Entities::ClusterGroup
+        else
+          render_validation_error!(user_cluster)
+        end
+      end
+
+      desc 'Update an existing cluster' do
+        success Entities::ClusterGroup
+      end
+      params do
+        requires :cluster_id, type: Integer, desc: 'The cluster ID'
+        optional :name, type: String, desc: 'Cluster name'
+        optional :domain, type: String, desc: 'Cluster base domain'
+        optional :platform_kubernetes_attributes, type: Hash, desc: %q(Platform Kubernetes data) do
+          optional :api_url, type: String, desc: 'URL to access the Kubernetes API'
+          optional :token, type: String, desc: 'Token to authenticate against Kubernetes'
+          optional :ca_cert, type: String, desc: 'TLS certificate (needed if API is using a self-signed TLS certificate)'
+          optional :namespace, type: String, desc: 'Unique namespace related to Group'
+        end
+        use :update_params_ee
+      end
+      put ':id/clusters/:cluster_id' do
+        authorize! :update_cluster, cluster
+
+        update_service = Clusters::UpdateService.new(current_user, update_cluster_params)
+
+        if update_service.execute(cluster)
+          present cluster, with: Entities::ClusterGroup
+        else
+          render_validation_error!(cluster)
+        end
+      end
+
+      desc 'Remove a cluster' do
+        success Entities::ClusterGroup
+      end
+      params do
+        requires :cluster_id, type: Integer, desc: 'The Cluster ID'
+      end
+      delete ':id/clusters/:cluster_id' do
+        authorize! :admin_cluster, cluster
+
+        destroy_conditionally!(cluster)
+      end
+    end
+
+    helpers do
+      def clusters_for_current_user
+        @clusters_for_current_user ||= ClustersFinder.new(user_group, current_user, :all).execute
+      end
+
+      def cluster
+        @cluster ||= clusters_for_current_user.find(params[:cluster_id])
+      end
+
+      def create_cluster_user_params
+        declared_params.merge({
+          provider_type: :user,
+          platform_type: :kubernetes,
+          clusterable: user_group
+        })
+      end
+
+      def update_cluster_params
+        declared_params(include_missing: false).without(:cluster_id)
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/graphql_helpers.rb b/lib/api/helpers/graphql_helpers.rb
index 94010ab1bc2..bd60470fbd6 100644
--- a/lib/api/helpers/graphql_helpers.rb
+++ b/lib/api/helpers/graphql_helpers.rb
@@ -7,8 +7,6 @@ module API
     # should be in app/graphql/ or lib/gitlab/graphql/
     module GraphqlHelpers
       def conditionally_graphql!(fallback:, query:, context: {}, transform: nil)
-        return fallback.call unless Feature.enabled?(:graphql)
-
         result = GitlabSchema.execute(query, context: context)
 
         if transform
diff --git a/lib/api/helpers/internal_helpers.rb b/lib/api/helpers/internal_helpers.rb
index c318f5b9127..9afe6c5b027 100644
--- a/lib/api/helpers/internal_helpers.rb
+++ b/lib/api/helpers/internal_helpers.rb
@@ -72,7 +72,7 @@ module API
 
         result == 'PONG'
       rescue => e
-        Rails.logger.warn("GitLab: An unexpected error occurred in pinging to Redis: #{e}")
+        Rails.logger.warn("GitLab: An unexpected error occurred in pinging to Redis: #{e}") # rubocop:disable Gitlab/RailsLogger
         false
       end
 
diff --git a/lib/api/helpers/pagination.rb b/lib/api/helpers/pagination.rb
index 2a9b17ad22a..71bbc218f94 100644
--- a/lib/api/helpers/pagination.rb
+++ b/lib/api/helpers/pagination.rb
@@ -205,7 +205,9 @@ module API
 
           limited_total_count = pagination_data.total_count_with_limit
           if limited_total_count > Kaminari::ActiveRecordRelationMethods::MAX_COUNT_LIMIT
-            pagination_data.without_count
+            # The call to `total_count_with_limit` memoizes `@arel` because of a call to `references_eager_loaded_tables?`
+            # We need to call `reset` because `without_count` relies on `@arel` being unmemoized
+            pagination_data.reset.without_count
           else
             pagination_data
           end
diff --git a/lib/api/helpers/projects_helpers.rb b/lib/api/helpers/projects_helpers.rb
index f242f1fea0e..0e21a7a66fd 100644
--- a/lib/api/helpers/projects_helpers.rb
+++ b/lib/api/helpers/projects_helpers.rb
@@ -8,12 +8,26 @@ module API
 
       params :optional_project_params_ce do
         optional :description, type: String, desc: 'The description of the project'
+        optional :build_git_strategy, type: String, values: %w(fetch clone), desc: 'The Git strategy. Defaults to `fetch`'
+        optional :build_timeout, type: Integer, desc: 'Build timeout'
+        optional :auto_cancel_pending_pipelines, type: String, values: %w(disabled enabled), desc: 'Auto-cancel pending pipelines'
+        optional :build_coverage_regex, type: String, desc: 'Test coverage parsing'
         optional :ci_config_path, type: String, desc: 'The path to CI config file. Defaults to `.gitlab-ci.yml`'
+
+        # TODO: remove in API v5, replaced by *_access_level
         optional :issues_enabled, type: Boolean, desc: 'Flag indication if the issue tracker is enabled'
         optional :merge_requests_enabled, type: Boolean, desc: 'Flag indication if merge requests are enabled'
         optional :wiki_enabled, type: Boolean, desc: 'Flag indication if the wiki is enabled'
         optional :jobs_enabled, type: Boolean, desc: 'Flag indication if jobs are enabled'
         optional :snippets_enabled, type: Boolean, desc: 'Flag indication if snippets are enabled'
+
+        optional :issues_access_level, type: String, values: %w(disabled private enabled), desc: 'Issues access level. One of `disabled`, `private` or `enabled`'
+        optional :repository_access_level, type: String, values: %w(disabled private enabled), desc: 'Repository access level. One of `disabled`, `private` or `enabled`'
+        optional :merge_requests_access_level, type: String, values: %w(disabled private enabled), desc: 'Merge requests access level. One of `disabled`, `private` or `enabled`'
+        optional :wiki_access_level, type: String, values: %w(disabled private enabled), desc: 'Wiki access level. One of `disabled`, `private` or `enabled`'
+        optional :builds_access_level, type: String, values: %w(disabled private enabled), desc: 'Builds access level. One of `disabled`, `private` or `enabled`'
+        optional :snippets_access_level, type: String, values: %w(disabled private enabled), desc: 'Snippets access level. One of `disabled`, `private` or `enabled`'
+
         optional :shared_runners_enabled, type: Boolean, desc: 'Flag indication if shared runners are enabled for that project'
         optional :resolve_outdated_diff_discussions, type: Boolean, desc: 'Automatically resolve merge request diffs discussions on lines changed with a push'
         optional :container_registry_enabled, type: Boolean, desc: 'Flag indication if the container registry is enabled for that project'
@@ -30,6 +44,8 @@ module API
         optional :initialize_with_readme, type: Boolean, desc: "Initialize a project with a README.md"
         optional :external_authorization_classification_label, type: String, desc: 'The classification label for the project'
         optional :ci_default_git_depth, type: Integer, desc: 'Default number of revisions for shallow cloning'
+        optional :auto_devops_enabled, type: Boolean, desc: 'Flag indication if Auto DevOps is enabled'
+        optional :auto_devops_deploy_strategy, type: String, values: %w(continuous manual timed_incremental), desc: 'Auto Deploy strategy'
       end
 
       params :optional_project_params_ee do
@@ -48,15 +64,20 @@ module API
 
       def self.update_params_at_least_one_of
         [
-          :jobs_enabled,
-          :resolve_outdated_diff_discussions,
+          :auto_devops_enabled,
+          :auto_devops_deploy_strategy,
+          :auto_cancel_pending_pipelines,
+          :build_coverage_regex,
+          :build_git_strategy,
+          :build_timeout,
+          :builds_access_level,
           :ci_config_path,
           :container_registry_enabled,
           :default_branch,
           :description,
-          :issues_enabled,
+          :issues_access_level,
           :lfs_enabled,
-          :merge_requests_enabled,
+          :merge_requests_access_level,
           :merge_method,
           :name,
           :only_allow_merge_if_all_discussions_are_resolved,
@@ -64,14 +85,24 @@ module API
           :path,
           :printing_merge_request_link_enabled,
           :public_builds,
+          :repository_access_level,
           :request_access_enabled,
+          :resolve_outdated_diff_discussions,
           :shared_runners_enabled,
-          :snippets_enabled,
+          :snippets_access_level,
           :tag_list,
           :visibility,
-          :wiki_enabled,
+          :wiki_access_level,
           :avatar,
-          :external_authorization_classification_label
+          :external_authorization_classification_label,
+
+          # TODO: remove in API v5, replaced by *_access_level
+          :issues_enabled,
+          :jobs_enabled,
+          :merge_requests_enabled,
+          :wiki_enabled,
+          :jobs_enabled,
+          :snippets_enabled
         ]
       end
     end
diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb
index ff73a49d5e8..100463fcb95 100644
--- a/lib/api/helpers/runner.rb
+++ b/lib/api/helpers/runner.rb
@@ -7,8 +7,7 @@ module API
       JOB_TOKEN_PARAM = :token
 
       def runner_registration_token_valid?
-        ActiveSupport::SecurityUtils.variable_size_secure_compare(params[:token],
-                                                                  Gitlab::CurrentSettings.runners_registration_token)
+        ActiveSupport::SecurityUtils.secure_compare(params[:token], Gitlab::CurrentSettings.runners_registration_token)
       end
 
       def authenticate_runner!
diff --git a/lib/api/import_github.rb b/lib/api/import_github.rb
index e7504051808..21d4928193e 100644
--- a/lib/api/import_github.rb
+++ b/lib/api/import_github.rb
@@ -28,7 +28,7 @@ module API
 
     desc 'Import a GitHub project' do
       detail 'This feature was introduced in GitLab 11.3.4.'
-      success Entities::ProjectEntity
+      success ::ProjectEntity
     end
     params do
       requires :personal_access_token, type: String, desc: 'GitHub personal access token'
diff --git a/lib/api/project_clusters.rb b/lib/api/project_clusters.rb
index dcc8d94fb79..4f093e9be08 100644
--- a/lib/api/project_clusters.rb
+++ b/lib/api/project_clusters.rb
@@ -65,7 +65,7 @@ module API
         use :create_params_ee
       end
       post ':id/clusters/user' do
-        authorize! :add_cluster, user_project, 'Instance does not support multiple Kubernetes clusters'
+        authorize! :add_cluster, user_project
 
         user_cluster = ::Clusters::CreateService
           .new(current_user, create_cluster_user_params)
diff --git a/lib/api/user_counts.rb b/lib/api/user_counts.rb
new file mode 100644
index 00000000000..8df4b381bbf
--- /dev/null
+++ b/lib/api/user_counts.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module API
+  class UserCounts < Grape::API
+    resource :user_counts do
+      desc 'Return the user specific counts' do
+        detail 'Open MR Count'
+      end
+      get do
+        unauthorized! unless current_user
+
+        {
+          merge_requests: current_user.assigned_open_merge_requests_count
+        }
+      end
+    end
+  end
+end