Add latest changes from gitlab-org/security/gitlab@14-7-stable-ee

2 files changed, 31 insertions, 4 deletions

diff --git a/app/services/packages/mark_package_files_for_destruction_service.rb b/app/services/packages/mark_package_files_for_destruction_service.rb
new file mode 100644
index 00000000000..3672b44b409
--- /dev/null
+++ b/app/services/packages/mark_package_files_for_destruction_service.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Packages
+  # WARNING: ensure that permissions are verified before using this service.
+  class MarkPackageFilesForDestructionService
+    BATCH_SIZE = 500
+
+    def initialize(package_files)
+      @package_files = package_files
+    end
+
+    def execute
+      @package_files.each_batch(of: BATCH_SIZE) do |batched_package_files|
+        batched_package_files.update_all(status: :pending_destruction)
+      end
+
+      service_response_success('Package files are now pending destruction')
+    end
+
+    private
+
+    def service_response_success(message)
+      ServiceResponse.success(message: message)
+    end
+  end
+end
diff --git a/app/services/packages/destroy_package_service.rb b/app/services/packages/mark_package_for_destruction_service.rb
index 697f1fa3ac8..3417febe79a 100644
--- a/app/services/packages/destroy_package_service.rb
+++ b/app/services/packages/mark_package_for_destruction_service.rb
@@ -1,19 +1,20 @@
 # frozen_string_literal: true
 
 module Packages
-  class DestroyPackageService < BaseContainerService
+  class MarkPackageForDestructionService < BaseContainerService
     alias_method :package, :container
 
     def execute
       return service_response_error("You don't have access to this package", 403) unless user_can_delete_package?
 
-      package.destroy!
+      package.pending_destruction!
 
+      package.mark_package_files_for_destruction
       package.sync_maven_metadata(current_user)
 
-      service_response_success('Package was successfully deleted')
+      service_response_success('Package was successfully marked as pending destruction')
     rescue StandardError
-      service_response_error('Failed to remove the package', 400)
+      service_response_error('Failed to mark the package as pending destruction', 400)
     end
 
     private