Add latest changes from gitlab-org/security/gitlab@16-1-stable-ee

2 files changed, 18 insertions, 6 deletions

diff --git a/app/services/error_tracking/list_projects_service.rb b/app/services/error_tracking/list_projects_service.rb
index 35a8179d54d..1539e24df9d 100644
--- a/app/services/error_tracking/list_projects_service.rb
+++ b/app/services/error_tracking/list_projects_service.rb
@@ -20,22 +20,20 @@ module ErrorTracking
 
     def project_error_tracking_setting
       (super || project.build_error_tracking_setting).tap do |setting|
-        url_changed = !setting.api_url&.start_with?(params[:api_host])
-
         setting.api_url = ErrorTracking::ProjectErrorTrackingSetting.build_api_url_from(
           api_host: params[:api_host],
           organization_slug: 'org',
           project_slug: 'proj'
         )
 
-        setting.token = token(setting, url_changed)
+        setting.token = token(setting)
         setting.enabled = true
       end
     end
     strong_memoize_attr :project_error_tracking_setting
 
-    def token(setting, url_changed)
-      return if url_changed && masked_token?
+    def token(setting)
+      return if setting.api_url_changed? && masked_token?
 
       # Use param token if not masked, otherwise use database token
       return params[:token] unless masked_token?
diff --git a/spec/services/error_tracking/list_projects_service_spec.rb b/spec/services/error_tracking/list_projects_service_spec.rb
index 8408adcc21d..d91808edc8d 100644
--- a/spec/services/error_tracking/list_projects_service_spec.rb
+++ b/spec/services/error_tracking/list_projects_service_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe ErrorTracking::ListProjectsService, feature_category: :integratio
   let_it_be(:user) { create(:user) }
   let_it_be(:project, reload: true) { create(:project) }
 
-  let(:sentry_url) { 'https://sentrytest.gitlab.com/api/0/projects/sentry-org/sentry-project' }
+  let(:sentry_url) { 'https://sentrytest.gitlab.com/api/0/projects/org/proj/' }
   let(:token) { 'test-token' }
   let(:new_api_host) { 'https://gitlab.com/' }
   let(:new_token) { 'new-token' }
@@ -66,6 +66,20 @@ RSpec.describe ErrorTracking::ListProjectsService, feature_category: :integratio
           end
         end
 
+        context 'with the similar api host' do
+          let(:api_host) { 'https://sentrytest.gitlab.co' }
+
+          it 'returns an error' do
+            expect(result[:message]).to start_with('Token is a required field')
+            expect(error_tracking_setting).not_to be_valid
+            expect(error_tracking_setting).not_to receive(:list_sentry_projects)
+          end
+
+          it 'resets the token' do
+            expect { subject.execute }.to change { error_tracking_setting.token }.from(token).to(nil)
+          end
+        end
+
         context 'with a new api host' do
           let(:api_host) { new_api_host }