Add latest changes from gitlab-org/gitlab@master

13 files changed, 113 insertions, 39 deletions

diff --git a/Gemfile b/Gemfile
index c3442ebb92b..5a52a7e13ad 100644
--- a/Gemfile
+++ b/Gemfile
@@ -481,7 +481,7 @@ gem 'grpc', '~> 1.30.2'
 
 gem 'google-protobuf', '~> 3.17.1'
 
-gem 'toml-rb', '~> 1.0.0'
+gem 'toml-rb', '~> 2.0'
 
 # Feature toggles
 gem 'flipper', '~> 0.21.0'
diff --git a/Gemfile.lock b/Gemfile.lock
index cbad24f5639..9237261d7c1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1290,7 +1290,7 @@ GEM
     to_regexp (0.2.1)
     toml (0.2.0)
       parslet (~> 1.8.0)
-    toml-rb (1.0.0)
+    toml-rb (2.0.1)
       citrus (~> 3.0, > 3.0)
     tomlrb (1.3.0)
     tpm-key_attestation (0.9.0)
@@ -1660,7 +1660,7 @@ DEPENDENCIES
   thin (~> 1.8.0)
   thrift (>= 0.14.0)
   timecop (~> 0.9.1)
-  toml-rb (~> 1.0.0)
+  toml-rb (~> 2.0)
   truncato (~> 0.7.11)
   u2f (~> 0.2.1)
   unf (~> 0.1.4)
diff --git a/app/models/user.rb b/app/models/user.rb
index 077f11d574f..eb93d717e9b 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1887,7 +1887,8 @@ class User < ApplicationRecord
   end
 
   def password_expired_if_applicable?
-    return false unless password_expired?
+    return false if bot?
+    return false unless password_expired? && password_automatically_set?
     return false unless allow_password_authentication?
 
     true
diff --git a/lib/gitlab/template/gitlab_ci_yml_template.rb b/lib/gitlab/template/gitlab_ci_yml_template.rb
index e302865c897..da925f0f83a 100644
--- a/lib/gitlab/template/gitlab_ci_yml_template.rb
+++ b/lib/gitlab/template/gitlab_ci_yml_template.rb
@@ -92,4 +92,4 @@ module Gitlab
   end
 end
 
-Gitlab::Template::GitlabCiYmlTemplate.prepend_mod_with('Gitlab::Template::GitlabCiYmlTemplate')
+Gitlab::Template::GitlabCiYmlTemplate.prepend_mod
diff --git a/spec/graphql/types/project_type_spec.rb b/spec/graphql/types/project_type_spec.rb
index 22a1f065aa6..8a1a4b17cc6 100644
--- a/spec/graphql/types/project_type_spec.rb
+++ b/spec/graphql/types/project_type_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe GitlabSchema.types['Project'] do
   include GraphqlHelpers
+  include Ci::TemplateHelpers
 
   specify { expect(described_class).to expose_permissions_using(Types::PermissionTypes::Project) }
 
@@ -103,15 +104,14 @@ RSpec.describe GitlabSchema.types['Project'] do
     subject { GitlabSchema.execute(query, context: { current_user: user }).as_json }
 
     it "returns the project's sast configuration for global variables" do
-      secure_analyzers_prefix = subject.dig('data', 'project', 'sastCiConfiguration', 'global', 'nodes').first
-      expect(secure_analyzers_prefix['type']).to eq('string')
-      expect(secure_analyzers_prefix['field']).to eq('SECURE_ANALYZERS_PREFIX')
-      expect(secure_analyzers_prefix['label']).to eq('Image prefix')
-      expect(secure_analyzers_prefix['defaultValue'])
-        .to eq('registry.gitlab.com/gitlab-org/security-products/analyzers')
-      expect(secure_analyzers_prefix['value']).to eq('registry.gitlab.com/gitlab-org/security-products/analyzers')
-      expect(secure_analyzers_prefix['size']).to eq('LARGE')
-      expect(secure_analyzers_prefix['options']).to be_nil
+      secure_analyzers = subject.dig('data', 'project', 'sastCiConfiguration', 'global', 'nodes').first
+      expect(secure_analyzers['type']).to eq('string')
+      expect(secure_analyzers['field']).to eq('SECURE_ANALYZERS_PREFIX')
+      expect(secure_analyzers['label']).to eq('Image prefix')
+      expect(secure_analyzers['defaultValue']).to eq(secure_analyzers_prefix)
+      expect(secure_analyzers['value']).to eq(secure_analyzers_prefix)
+      expect(secure_analyzers['size']).to eq('LARGE')
+      expect(secure_analyzers['options']).to be_nil
     end
 
     it "returns the project's sast configuration for pipeline variables" do
diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb
index 3a10ce1a30e..bf682e4e4c6 100644
--- a/spec/lib/gitlab/git_access_spec.rb
+++ b/spec/lib/gitlab/git_access_spec.rb
@@ -435,7 +435,7 @@ RSpec.describe Gitlab::GitAccess do
 
     it 'disallows users with expired password to pull' do
       project.add_maintainer(user)
-      user.update!(password_expires_at: 2.minutes.ago)
+      user.update!(password_expires_at: 2.minutes.ago, password_automatically_set: true)
 
       expect { pull_access_check }.to raise_forbidden("Your password expired. Please access GitLab from a web browser to update your password.")
     end
@@ -987,7 +987,7 @@ RSpec.describe Gitlab::GitAccess do
       end
 
       it 'disallows users with expired password to push' do
-        user.update!(password_expires_at: 2.minutes.ago)
+        user.update!(password_expires_at: 2.minutes.ago, password_automatically_set: true)
 
         expect { push_access_check }.to raise_forbidden("Your password expired. Please access GitLab from a web browser to update your password.")
       end
diff --git a/spec/lib/gitlab/lfs_token_spec.rb b/spec/lib/gitlab/lfs_token_spec.rb
index 4b40e8960b2..a8472062f03 100644
--- a/spec/lib/gitlab/lfs_token_spec.rb
+++ b/spec/lib/gitlab/lfs_token_spec.rb
@@ -126,7 +126,7 @@ RSpec.describe Gitlab::LfsToken, :clean_gitlab_redis_shared_state do
         end
 
         context 'when the user password is expired' do
-          let(:actor) { create(:user, password_expires_at: 1.minute.ago) }
+          let(:actor) { create(:user, password_expires_at: 1.minute.ago, password_automatically_set: true) }
 
           it 'returns false' do
             expect(lfs_token.token_valid?(lfs_token.token)).to be false
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 62c482baa44..6cc7e78fbd0 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -5275,11 +5275,43 @@ RSpec.describe User do
   end
 
   describe '#password_expired_if_applicable?' do
-    let(:user) { build(:user, password_expires_at: password_expires_at) }
+    let(:user) { build(:user, password_expires_at: password_expires_at, password_automatically_set: set_automatically?) }
 
     subject { user.password_expired_if_applicable? }
 
     context 'when user is not ldap user' do
+      context 'when user has password set automatically' do
+        let(:set_automatically?) { true }
+
+        context 'when password_expires_at is not set' do
+          let(:password_expires_at) {}
+
+          it 'returns false' do
+            is_expected.to be_falsey
+          end
+        end
+
+        context 'when password_expires_at is in the past' do
+          let(:password_expires_at) { 1.minute.ago }
+
+          it 'returns true' do
+            is_expected.to be_truthy
+          end
+        end
+
+        context 'when password_expires_at is in the future' do
+          let(:password_expires_at) { 1.minute.from_now }
+
+          it 'returns false' do
+            is_expected.to be_falsey
+          end
+        end
+      end
+    end
+
+    context 'when user has password not set automatically' do
+      let(:set_automatically?) { false }
+
       context 'when password_expires_at is not set' do
         let(:password_expires_at) {}
 
@@ -5291,8 +5323,8 @@ RSpec.describe User do
       context 'when password_expires_at is in the past' do
         let(:password_expires_at) { 1.minute.ago }
 
-        it 'returns true' do
-          is_expected.to be_truthy
+        it 'returns false' do
+          is_expected.to be_falsey
         end
       end
 
@@ -5336,6 +5368,34 @@ RSpec.describe User do
         end
       end
     end
+
+    context 'when user is a project bot' do
+      let(:user) { build(:user, :project_bot, password_expires_at: password_expires_at) }
+
+      context 'when password_expires_at is not set' do
+        let(:password_expires_at) {}
+
+        it 'returns false' do
+          is_expected.to be_falsey
+        end
+      end
+
+      context 'when password_expires_at is in the past' do
+        let(:password_expires_at) { 1.minute.ago }
+
+        it 'returns false' do
+          is_expected.to be_falsey
+        end
+      end
+
+      context 'when password_expires_at is in the future' do
+        let(:password_expires_at) { 1.minute.from_now }
+
+        it 'returns false' do
+          is_expected.to be_falsey
+        end
+      end
+    end
   end
 
   describe '#read_only_attribute?' do
diff --git a/spec/policies/global_policy_spec.rb b/spec/policies/global_policy_spec.rb
index 85026ced466..122612df355 100644
--- a/spec/policies/global_policy_spec.rb
+++ b/spec/policies/global_policy_spec.rb
@@ -249,7 +249,7 @@ RSpec.describe GlobalPolicy do
 
     context 'user with expired password' do
       before do
-        current_user.update!(password_expires_at: 2.minutes.ago)
+        current_user.update!(password_expires_at: 2.minutes.ago, password_automatically_set: true)
       end
 
       it { is_expected.not_to be_allowed(:access_api) }
@@ -445,7 +445,7 @@ RSpec.describe GlobalPolicy do
 
     context 'user with expired password' do
       before do
-        current_user.update!(password_expires_at: 2.minutes.ago)
+        current_user.update!(password_expires_at: 2.minutes.ago, password_automatically_set: true)
       end
 
       it { is_expected.not_to be_allowed(:access_git) }
@@ -537,7 +537,7 @@ RSpec.describe GlobalPolicy do
 
     context 'user with expired password' do
       before do
-        current_user.update!(password_expires_at: 2.minutes.ago)
+        current_user.update!(password_expires_at: 2.minutes.ago, password_automatically_set: true)
       end
 
       it { is_expected.not_to be_allowed(:use_slash_commands) }
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index 40005596c3e..b80b3f4e159 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -61,7 +61,7 @@ RSpec.describe 'Git HTTP requests' do
   shared_examples 'operations are not allowed with expired password' do
     context "when password is expired" do
       it "responds to downloads with status 401 Unauthorized" do
-        user.update!(password_expires_at: 2.days.ago)
+        user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
         download(path, user: user.username, password: user.password) do |response|
           expect(response).to have_gitlab_http_status(:unauthorized)
@@ -69,7 +69,7 @@ RSpec.describe 'Git HTTP requests' do
       end
 
       it "responds to uploads with status 401 Unauthorized" do
-        user.update!(password_expires_at: 2.days.ago)
+        user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
         upload(path, user: user.username, password: user.password) do |response|
           expect(response).to have_gitlab_http_status(:unauthorized)
@@ -614,7 +614,7 @@ RSpec.describe 'Git HTTP requests' do
 
                 context "when password is expired" do
                   it "responds to downloads with status 401 unauthorized" do
-                    user.update!(password_expires_at: 2.days.ago)
+                    user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                     download(path, **env) do |response|
                       expect(response).to have_gitlab_http_status(:unauthorized)
@@ -697,7 +697,7 @@ RSpec.describe 'Git HTTP requests' do
 
                   context "when password is expired" do
                     it "responds to uploads with status 401 unauthorized" do
-                      user.update!(password_expires_at: 2.days.ago)
+                      user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                       write_access_token = create(:personal_access_token, user: user, scopes: [:write_repository])
 
@@ -920,7 +920,7 @@ RSpec.describe 'Git HTTP requests' do
 
               context 'when users password is expired' do
                 it 'rejects pulls with 401 unauthorized' do
-                  user.update!(password_expires_at: 2.days.ago)
+                  user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                   download(path, user: 'gitlab-ci-token', password: build.token) do |response|
                     expect(response).to have_gitlab_http_status(:unauthorized)
@@ -1215,7 +1215,7 @@ RSpec.describe 'Git HTTP requests' do
 
                 context "when password is expired" do
                   it "responds to downloads with status 401 unauthorized" do
-                    user.update!(password_expires_at: 2.days.ago)
+                    user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                     download(path, **env) do |response|
                       expect(response).to have_gitlab_http_status(:unauthorized)
@@ -1298,7 +1298,7 @@ RSpec.describe 'Git HTTP requests' do
 
                   context "when password is expired" do
                     it "responds to uploads with status 401 unauthorized" do
-                      user.update!(password_expires_at: 2.days.ago)
+                      user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                       write_access_token = create(:personal_access_token, user: user, scopes: [:write_repository])
 
@@ -1521,7 +1521,7 @@ RSpec.describe 'Git HTTP requests' do
 
               context 'when users password is expired' do
                 it 'rejects pulls with 401 unauthorized' do
-                  user.update!(password_expires_at: 2.days.ago)
+                  user.update!(password_expires_at: 2.days.ago, password_automatically_set: true)
 
                   download(path, user: 'gitlab-ci-token', password: build.token) do |response|
                     expect(response).to have_gitlab_http_status(:unauthorized)
diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb
index 975026c724e..833889431e9 100644
--- a/spec/requests/lfs_http_spec.rb
+++ b/spec/requests/lfs_http_spec.rb
@@ -126,7 +126,7 @@ RSpec.describe 'Git LFS API and storage' do
             it_behaves_like 'LFS http 200 blob response'
 
             context 'when user password is expired' do
-              let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)}
+              let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago, password_automatically_set: true)}
 
               it_behaves_like 'LFS http 401 response'
             end
@@ -344,7 +344,7 @@ RSpec.describe 'Git LFS API and storage' do
             end
 
             context 'when user password is expired' do
-              let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)}
+              let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago, password_automatically_set: true)}
 
               let(:role) { :reporter}
 
@@ -958,7 +958,7 @@ RSpec.describe 'Git LFS API and storage' do
               it_behaves_like 'LFS http 200 workhorse response'
 
               context 'when user password is expired' do
-                let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)}
+                let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago, password_automatically_set: true) }
 
                 it_behaves_like 'LFS http 401 response'
               end
diff --git a/spec/services/security/ci_configuration/sast_parser_service_spec.rb b/spec/services/security/ci_configuration/sast_parser_service_spec.rb
index 4fe99f20879..4346d0a9e07 100644
--- a/spec/services/security/ci_configuration/sast_parser_service_spec.rb
+++ b/spec/services/security/ci_configuration/sast_parser_service_spec.rb
@@ -3,11 +3,13 @@
 require 'spec_helper'
 
 RSpec.describe Security::CiConfiguration::SastParserService do
+  include Ci::TemplateHelpers
+
   describe '#configuration' do
     include_context 'read ci configuration for sast enabled project'
 
     let(:configuration) { described_class.new(project).configuration }
-    let(:secure_analyzers_prefix) { configuration['global'][0] }
+    let(:secure_analyzers) { configuration['global'][0] }
     let(:sast_excluded_paths) { configuration['global'][1] }
     let(:sast_pipeline_stage) { configuration['pipeline'][0] }
     let(:sast_search_max_depth) { configuration['pipeline'][1] }
@@ -16,7 +18,7 @@ RSpec.describe Security::CiConfiguration::SastParserService do
     let(:sast_brakeman_level) { brakeman['variables'][0] }
 
     it 'parses the configuration for SAST' do
-      expect(secure_analyzers_prefix['default_value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers')
+      expect(secure_analyzers['default_value']).to eql(secure_analyzers_prefix)
       expect(sast_excluded_paths['default_value']).to eql('spec, test, tests, tmp')
       expect(sast_pipeline_stage['default_value']).to eql('test')
       expect(sast_search_max_depth['default_value']).to eql('4')
@@ -28,7 +30,7 @@ RSpec.describe Security::CiConfiguration::SastParserService do
       context 'when .gitlab-ci.yml is present' do
         it 'populates the current values from the file' do
           allow(project.repository).to receive(:blob_data_at).and_return(gitlab_ci_yml_content)
-          expect(secure_analyzers_prefix['value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers2')
+          expect(secure_analyzers['value']).to eql("registry.gitlab.com/gitlab-org/security-products/analyzers2")
           expect(sast_excluded_paths['value']).to eql('spec, executables')
           expect(sast_pipeline_stage['value']).to eql('our_custom_security_stage')
           expect(sast_search_max_depth['value']).to eql('8')
@@ -50,7 +52,7 @@ RSpec.describe Security::CiConfiguration::SastParserService do
       context 'when .gitlab-ci.yml is absent' do
         it 'populates the current values with the default values' do
           allow(project.repository).to receive(:blob_data_at).and_return(nil)
-          expect(secure_analyzers_prefix['value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers')
+          expect(secure_analyzers['value']).to eql(secure_analyzers_prefix)
           expect(sast_excluded_paths['value']).to eql('spec, test, tests, tmp')
           expect(sast_pipeline_stage['value']).to eql('test')
           expect(sast_search_max_depth['value']).to eql('4')
@@ -67,7 +69,7 @@ RSpec.describe Security::CiConfiguration::SastParserService do
         end
 
         it 'populates the current values with the default values' do
-          expect(secure_analyzers_prefix['value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers')
+          expect(secure_analyzers['value']).to eql(secure_analyzers_prefix)
           expect(sast_excluded_paths['value']).to eql('spec, test, tests, tmp')
           expect(sast_pipeline_stage['value']).to eql('test')
           expect(sast_search_max_depth['value']).to eql('4')
diff --git a/spec/support/helpers/ci/template_helpers.rb b/spec/support/helpers/ci/template_helpers.rb
new file mode 100644
index 00000000000..7bab58a574e
--- /dev/null
+++ b/spec/support/helpers/ci/template_helpers.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Ci
+  module TemplateHelpers
+    def secure_analyzers_prefix
+      'registry.gitlab.com/gitlab-org/security-products/analyzers'
+    end
+  end
+end
+
+Ci::TemplateHelpers.prepend_mod