Add latest changes from gitlab-org/gitlab@13-5-stable-eev13.5.0-rc42

15 files changed, 34 insertions, 1 deletions

diff --git a/app/controllers/profiles/accounts_controller.rb b/app/controllers/profiles/accounts_controller.rb
index b19285e98bb..d8419be9f23 100644
--- a/app/controllers/profiles/accounts_controller.rb
+++ b/app/controllers/profiles/accounts_controller.rb
@@ -3,6 +3,8 @@
 class Profiles::AccountsController < Profiles::ApplicationController
   include AuthHelper
 
+  feature_category :users
+
   def show
     render(locals: show_view_variables)
   end
diff --git a/app/controllers/profiles/active_sessions_controller.rb b/app/controllers/profiles/active_sessions_controller.rb
index e4cd5d65e1a..1233c906406 100644
--- a/app/controllers/profiles/active_sessions_controller.rb
+++ b/app/controllers/profiles/active_sessions_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::ActiveSessionsController < Profiles::ApplicationController
+  feature_category :users
+
   def index
     @sessions = ActiveSession.list(current_user).reject(&:is_impersonated)
   end
diff --git a/app/controllers/profiles/avatars_controller.rb b/app/controllers/profiles/avatars_controller.rb
index 3378a09628c..d9e4b9a149d 100644
--- a/app/controllers/profiles/avatars_controller.rb
+++ b/app/controllers/profiles/avatars_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::AvatarsController < Profiles::ApplicationController
+  feature_category :users
+
   def destroy
     @user = current_user
 
diff --git a/app/controllers/profiles/chat_names_controller.rb b/app/controllers/profiles/chat_names_controller.rb
index 80b8279e91e..8cfec247b7a 100644
--- a/app/controllers/profiles/chat_names_controller.rb
+++ b/app/controllers/profiles/chat_names_controller.rb
@@ -4,6 +4,8 @@ class Profiles::ChatNamesController < Profiles::ApplicationController
   before_action :chat_name_token, only: [:new]
   before_action :chat_name_params, only: [:new, :create, :deny]
 
+  feature_category :users
+
   def index
     @chat_names = current_user.chat_names
   end
diff --git a/app/controllers/profiles/emails_controller.rb b/app/controllers/profiles/emails_controller.rb
index da553e34ef6..6e5b18cb885 100644
--- a/app/controllers/profiles/emails_controller.rb
+++ b/app/controllers/profiles/emails_controller.rb
@@ -5,6 +5,8 @@ class Profiles::EmailsController < Profiles::ApplicationController
   before_action -> { rate_limit!(:profile_add_new_email) }, only: [:create]
   before_action -> { rate_limit!(:profile_resend_email_confirmation) }, only: [:resend_confirmation_instructions]
 
+  feature_category :users
+
   def index
     @primary_email = current_user.email
     @emails = current_user.emails.order_id_desc
diff --git a/app/controllers/profiles/gpg_keys_controller.rb b/app/controllers/profiles/gpg_keys_controller.rb
index 8c34a66c374..7f04927f517 100644
--- a/app/controllers/profiles/gpg_keys_controller.rb
+++ b/app/controllers/profiles/gpg_keys_controller.rb
@@ -3,6 +3,8 @@
 class Profiles::GpgKeysController < Profiles::ApplicationController
   before_action :set_gpg_key, only: [:destroy, :revoke]
 
+  feature_category :users
+
   def index
     @gpg_keys = current_user.gpg_keys.with_subkeys
     @gpg_key = GpgKey.new
diff --git a/app/controllers/profiles/groups_controller.rb b/app/controllers/profiles/groups_controller.rb
index 04b5ee270dc..e76ee0a6cea 100644
--- a/app/controllers/profiles/groups_controller.rb
+++ b/app/controllers/profiles/groups_controller.rb
@@ -3,6 +3,8 @@
 class Profiles::GroupsController < Profiles::ApplicationController
   include RoutableActions
 
+  feature_category :users
+
   def update
     group = find_routable!(Group, params[:id])
     notification_setting = current_user.notification_settings_for(group)
diff --git a/app/controllers/profiles/keys_controller.rb b/app/controllers/profiles/keys_controller.rb
index 965493955ac..1e6340f285e 100644
--- a/app/controllers/profiles/keys_controller.rb
+++ b/app/controllers/profiles/keys_controller.rb
@@ -3,6 +3,8 @@
 class Profiles::KeysController < Profiles::ApplicationController
   skip_before_action :authenticate_user!, only: [:get_keys]
 
+  feature_category :users
+
   def index
     @keys = current_user.keys.order_id_desc
     @key = Key.new
diff --git a/app/controllers/profiles/notifications_controller.rb b/app/controllers/profiles/notifications_controller.rb
index bc51830c119..a3e7638cdbc 100644
--- a/app/controllers/profiles/notifications_controller.rb
+++ b/app/controllers/profiles/notifications_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::NotificationsController < Profiles::ApplicationController
+  feature_category :users
+
   # rubocop: disable CodeReuse/ActiveRecord
   def show
     @user = current_user
diff --git a/app/controllers/profiles/passwords_controller.rb b/app/controllers/profiles/passwords_controller.rb
index fccbc29f598..85e901eb3eb 100644
--- a/app/controllers/profiles/passwords_controller.rb
+++ b/app/controllers/profiles/passwords_controller.rb
@@ -9,6 +9,8 @@ class Profiles::PasswordsController < Profiles::ApplicationController
 
   layout :determine_layout
 
+  feature_category :authentication_and_authorization
+
   def new
   end
 
diff --git a/app/controllers/profiles/personal_access_tokens_controller.rb b/app/controllers/profiles/personal_access_tokens_controller.rb
index 21adc032940..b005347c43a 100644
--- a/app/controllers/profiles/personal_access_tokens_controller.rb
+++ b/app/controllers/profiles/personal_access_tokens_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::PersonalAccessTokensController < Profiles::ApplicationController
+  feature_category :authentication_and_authorization
+
   def index
     set_index_vars
     @personal_access_token = finder.build
diff --git a/app/controllers/profiles/preferences_controller.rb b/app/controllers/profiles/preferences_controller.rb
index ea4d3e861be..4d88491e9a8 100644
--- a/app/controllers/profiles/preferences_controller.rb
+++ b/app/controllers/profiles/preferences_controller.rb
@@ -3,6 +3,8 @@
 class Profiles::PreferencesController < Profiles::ApplicationController
   before_action :user
 
+  feature_category :users
+
   def show
   end
 
diff --git a/app/controllers/profiles/two_factor_auths_controller.rb b/app/controllers/profiles/two_factor_auths_controller.rb
index 5de6d84fdd9..e2f8baa8226 100644
--- a/app/controllers/profiles/two_factor_auths_controller.rb
+++ b/app/controllers/profiles/two_factor_auths_controller.rb
@@ -6,6 +6,8 @@ class Profiles::TwoFactorAuthsController < Profiles::ApplicationController
     push_frontend_feature_flag(:webauthn)
   end
 
+  feature_category :authentication_and_authorization
+
   def show
     unless current_user.two_factor_enabled?
       current_user.otp_secret = User.generate_otp_secret(32)
@@ -45,7 +47,10 @@ class Profiles::TwoFactorAuthsController < Profiles::ApplicationController
   end
 
   def create
-    if current_user.validate_and_consume_otp!(params[:pin_code])
+    otp_validation_result =
+      ::Users::ValidateOtpService.new(current_user).execute(params[:pin_code])
+
+    if otp_validation_result[:status] == :success
       ActiveSession.destroy_all_but_current(current_user, session)
 
       Users::UpdateService.new(current_user, user: current_user, otp_required_for_login: true).execute! do |user|
diff --git a/app/controllers/profiles/u2f_registrations_controller.rb b/app/controllers/profiles/u2f_registrations_controller.rb
index 84ce4a56e64..32ca303e722 100644
--- a/app/controllers/profiles/u2f_registrations_controller.rb
+++ b/app/controllers/profiles/u2f_registrations_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::U2fRegistrationsController < Profiles::ApplicationController
+  feature_category :authentication_and_authorization
+
   def destroy
     u2f_registration = current_user.u2f_registrations.find(params[:id])
     u2f_registration.destroy
diff --git a/app/controllers/profiles/webauthn_registrations_controller.rb b/app/controllers/profiles/webauthn_registrations_controller.rb
index 81b1dd6f710..a4a6d84f1ae 100644
--- a/app/controllers/profiles/webauthn_registrations_controller.rb
+++ b/app/controllers/profiles/webauthn_registrations_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Profiles::WebauthnRegistrationsController < Profiles::ApplicationController
+  feature_category :authentication_and_authorization
+
   def destroy
     webauthn_registration = current_user.webauthn_registrations.find(params[:id])
     webauthn_registration.destroy