Add latest changes from gitlab-org/gitlab@master

8 files changed, 60 insertions, 12 deletions

diff --git a/app/services/groups/transfer_service.rb b/app/services/groups/transfer_service.rb
index 7e9fd9dad54..1c8df157716 100644
--- a/app/services/groups/transfer_service.rb
+++ b/app/services/groups/transfer_service.rb
@@ -60,7 +60,7 @@ module Groups
       raise_transfer_error(:namespace_with_same_path) if namespace_with_same_path?
       raise_transfer_error(:group_contains_images) if group_projects_contain_registry_images?
       raise_transfer_error(:cannot_transfer_to_subgroup) if transfer_to_subgroup?
-      raise_transfer_error(:group_contains_npm_packages) if group_with_npm_packages?
+      raise_transfer_error(:group_contains_namespaced_npm_packages) if group_with_namespaced_npm_packages?
       raise_transfer_error(:no_permissions_to_migrate_crm) if no_permissions_to_migrate_crm?
     end
 
@@ -74,10 +74,11 @@ module Groups
       false
     end
 
-    def group_with_npm_packages?
+    def group_with_namespaced_npm_packages?
       return false unless group.packages_feature_enabled?
 
-      npm_packages = ::Packages::GroupPackagesFinder.new(current_user, group, package_type: :npm).execute
+      npm_packages = ::Packages::GroupPackagesFinder.new(current_user, group, package_type: :npm, preload_pipelines: false).execute
+      npm_packages = npm_packages.with_npm_scope(group.root_ancestor.path)
 
       different_root_ancestor? && npm_packages.exists?
     end
@@ -219,7 +220,7 @@ module Groups
         invalid_policies: s_("TransferGroup|You don't have enough permissions."),
         group_contains_images: s_('TransferGroup|Cannot update the path because there are projects under this group that contain Docker images in their Container Registry. Please remove the images from your projects first and try again.'),
         cannot_transfer_to_subgroup: s_('TransferGroup|Cannot transfer group to one of its subgroup.'),
-        group_contains_npm_packages: s_('TransferGroup|Group contains projects with NPM packages.'),
+        group_contains_namespaced_npm_packages: s_('TransferGroup|Group contains projects with NPM packages scoped to the current root level group.'),
         no_permissions_to_migrate_crm: s_("TransferGroup|Group contains contacts/organizations and you don't have enough permissions to move them to the new root group.")
       }.freeze
     end
diff --git a/app/services/import/base_service.rb b/app/services/import/base_service.rb
index 6b5adcbc39e..64cf3cfa04a 100644
--- a/app/services/import/base_service.rb
+++ b/app/services/import/base_service.rb
@@ -9,7 +9,7 @@ module Import
     end
 
     def authorized?
-      can?(current_user, :create_projects, target_namespace)
+      can?(current_user, :import_projects, target_namespace)
     end
 
     private
diff --git a/app/services/import/bitbucket_server_service.rb b/app/services/import/bitbucket_server_service.rb
index f7f17f1e53e..5d496dc7cc3 100644
--- a/app/services/import/bitbucket_server_service.rb
+++ b/app/services/import/bitbucket_server_service.rb
@@ -10,7 +10,7 @@ module Import
       end
 
       unless authorized?
-        return log_and_return_error("You don't have permissions to create this project", :unauthorized)
+        return log_and_return_error("You don't have permissions to import this project", :unauthorized)
       end
 
       unless repo
diff --git a/app/services/import/fogbugz_service.rb b/app/services/import/fogbugz_service.rb
index d1003823456..9a8def43312 100644
--- a/app/services/import/fogbugz_service.rb
+++ b/app/services/import/fogbugz_service.rb
@@ -13,8 +13,8 @@ module Import
 
       unless authorized?
         return log_and_return_error(
-          "You don't have permissions to create this project",
-          _("You don't have permissions to create this project"),
+          "You don't have permissions to import this project",
+          _("You don't have permissions to import this project"),
           :unauthorized
         )
       end
diff --git a/app/services/import/github_service.rb b/app/services/import/github_service.rb
index b30c344723d..7e7f7ea9810 100644
--- a/app/services/import/github_service.rb
+++ b/app/services/import/github_service.rb
@@ -103,7 +103,7 @@ module Import
       elsif target_namespace.nil?
         error(_('Namespace or group to import repository into does not exist.'), :unprocessable_entity)
       elsif !authorized?
-        error(_('This namespace has already been taken. Choose a different one.'), :unprocessable_entity)
+        error(_('You are not allowed to import projects in this namespace.'), :unprocessable_entity)
       elsif oversized?
         error(oversize_error_message, :unprocessable_entity)
       end
diff --git a/app/services/packages/npm/create_package_service.rb b/app/services/packages/npm/create_package_service.rb
index 33a7736dc95..b5a0a22a24e 100644
--- a/app/services/packages/npm/create_package_service.rb
+++ b/app/services/packages/npm/create_package_service.rb
@@ -35,11 +35,21 @@ module Packages
         ::Packages::CreateDependencyService.new(package, package_dependencies).execute
         ::Packages::Npm::CreateTagService.new(package, dist_tag).execute
 
-        package.create_npm_metadatum!(package_json: package_json)
+        create_npm_metadatum!(package)
 
         package
       end
 
+      def create_npm_metadatum!(package)
+        package.create_npm_metadatum!(package_json: package_json)
+      rescue ActiveRecord::RecordInvalid => e
+        if package.npm_metadatum && package.npm_metadatum.errors.added?(:package_json, 'structure is too large')
+          Gitlab::ErrorTracking.track_exception(e, field_sizes: field_sizes_for_error_tracking)
+        end
+
+        raise
+      end
+
       def current_package_exists?
         project.packages
                .npm
@@ -125,6 +135,35 @@ module Packages
       def lease_timeout
         DEFAULT_LEASE_TIMEOUT
       end
+
+      def field_sizes
+        strong_memoize(:field_sizes) do
+          package_json.transform_values do |value|
+            value.to_s.size
+          end
+        end
+      end
+
+      def filtered_field_sizes
+        strong_memoize(:filtered_field_sizes) do
+          field_sizes.select do |_, size|
+            size >= ::Packages::Npm::Metadatum::MIN_PACKAGE_JSON_FIELD_SIZE_FOR_ERROR_TRACKING
+          end
+        end
+      end
+
+      def largest_fields
+        strong_memoize(:largest_fields) do
+          field_sizes
+            .sort_by { |a| a[1] }
+            .reverse[0..::Packages::Npm::Metadatum::NUM_FIELDS_FOR_ERROR_TRACKING - 1]
+            .to_h
+        end
+      end
+
+      def field_sizes_for_error_tracking
+        filtered_field_sizes.empty? ? largest_fields : filtered_field_sizes
+      end
     end
   end
 end
diff --git a/app/services/projects/create_service.rb b/app/services/projects/create_service.rb
index cbea44d6aff..63b050faf9c 100644
--- a/app/services/projects/create_service.rb
+++ b/app/services/projects/create_service.rb
@@ -58,6 +58,7 @@ module Projects
       return @project if @project.errors.any?
 
       validate_create_permissions
+      validate_import_permissions
       return @project if @project.errors.any?
 
       @relations_block&.call(@project)
@@ -98,6 +99,13 @@ module Projects
       @project.errors.add(:namespace, "is not valid")
     end
 
+    def validate_import_permissions
+      return unless @project.import?
+      return if current_user.can?(:import_projects, parent_namespace)
+
+      @project.errors.add(:user, 'is not allowed to import projects')
+    end
+
     def after_create_actions
       log_info("#{current_user.name} created a new project \"#{@project.full_name}\"")
 
diff --git a/app/services/projects/transfer_service.rb b/app/services/projects/transfer_service.rb
index ed99c69be07..4a9d96d266c 100644
--- a/app/services/projects/transfer_service.rb
+++ b/app/services/projects/transfer_service.rb
@@ -63,8 +63,8 @@ module Projects
         raise TransferError, s_('TransferProject|Project cannot be transferred, because tags are present in its container registry')
       end
 
-      if project.has_packages?(:npm) && !new_namespace_has_same_root?(project)
-        raise TransferError, s_("TransferProject|Root namespace can't be updated if project has NPM packages")
+      if !new_namespace_has_same_root?(project) && project.has_namespaced_npm_packages?
+        raise TransferError, s_("TransferProject|Root namespace can't be updated if the project has NPM packages scoped to the current root level namespace.")
       end
 
       proceed_to_transfer