Add latest changes from gitlab-org/gitlab@master

3 files changed, 57 insertions, 19 deletions

diff --git a/app/services/auth/container_registry_authentication_service.rb b/app/services/auth/container_registry_authentication_service.rb
index 363510a41a1..7d473f9ed89 100644
--- a/app/services/auth/container_registry_authentication_service.rb
+++ b/app/services/auth/container_registry_authentication_service.rb
@@ -64,13 +64,16 @@ module Auth
     def self.push_pull_nested_repositories_access_token(name)
       name = name.chomp('/')
 
-      access_token({
-        name => %w[pull push],
-        "#{name}/*" => %w[pull]
-      })
+      access_token(
+        {
+          name => %w[pull push],
+          "#{name}/*" => %w[pull]
+        },
+        override_project_path: name
+      )
     end
 
-    def self.access_token(names_and_actions, type = 'repository')
+    def self.access_token(names_and_actions, type = 'repository', override_project_path: nil)
       registry = Gitlab.config.registry
       token = JSONWebToken::RSAToken.new(registry.key)
       token.issuer = registry.issuer
@@ -82,7 +85,7 @@ module Auth
           type: type,
           name: name,
           actions: actions,
-          meta: access_metadata(path: name)
+          meta: access_metadata(path: name, override_project_path: override_project_path)
         }.compact
       end
 
@@ -93,7 +96,9 @@ module Auth
       Time.current + Gitlab::CurrentSettings.container_registry_token_expire_delay.minutes
     end
 
-    def self.access_metadata(project: nil, path: nil)
+    def self.access_metadata(project: nil, path: nil, override_project_path: nil)
+      return { project_path: override_project_path.downcase } if override_project_path
+
       # If the project is not given, try to infer it from the provided path
       if project.nil?
         return if path.nil? # If no path is given, return early
diff --git a/app/services/projects/after_rename_service.rb b/app/services/projects/after_rename_service.rb
index 93d68eec3bc..e173655ed05 100644
--- a/app/services/projects/after_rename_service.rb
+++ b/app/services/projects/after_rename_service.rb
@@ -38,7 +38,7 @@ module Projects
     end
 
     def execute
-      first_ensure_no_registry_tags_are_present
+      rename_base_repository_in_registry!
       expire_caches_before_rename
       rename_or_migrate_repository!
       send_move_instructions
@@ -49,11 +49,25 @@ module Projects
       publish_event
     end
 
-    def first_ensure_no_registry_tags_are_present
+    def rename_base_repository_in_registry!
       return unless project.has_container_registry_tags?
 
-      raise RenameFailedError, "Project #{full_path_before} cannot be renamed because images are " \
-          "present in its container registry"
+      ensure_registry_tags_can_be_handled
+
+      result = ContainerRegistry::GitlabApiClient.rename_base_repository_path(
+        full_path_before, name: project_path)
+
+      return if result == :ok
+
+      rename_failed!("Renaming the base repository in the registry failed with error #{result}.")
+    end
+
+    def ensure_registry_tags_can_be_handled
+      return if Feature.enabled?(:renaming_project_with_tags, project) &&
+        ContainerRegistry::GitlabApiClient.supports_gitlab_api?
+
+      rename_failed!("Project #{full_path_before} cannot be renamed because images are " \
+      "present in its container registry")
     end
 
     def expire_caches_before_rename
@@ -66,7 +80,9 @@ module Projects
           .new(project, full_path_before)
           .execute
 
-      rename_failed! unless success
+      return if success
+
+      rename_failed!("Repository #{full_path_before} could not be renamed to #{full_path_after}")
     end
 
     def send_move_instructions
@@ -117,9 +133,7 @@ module Projects
       project.namespace.full_path
     end
 
-    def rename_failed!
-      error = "Repository #{full_path_before} could not be renamed to #{full_path_after}"
-
+    def rename_failed!(error)
       log_error(error)
 
       raise RenameFailedError, error
diff --git a/app/services/projects/update_service.rb b/app/services/projects/update_service.rb
index 336e887c241..cfcbe42997b 100644
--- a/app/services/projects/update_service.rb
+++ b/app/services/projects/update_service.rb
@@ -61,11 +61,8 @@ module Projects
         raise_validation_error(s_('UpdateProject|New visibility level not allowed!'))
       end
 
-      if renaming_project_with_container_registry_tags?
-        raise_validation_error(s_('UpdateProject|Cannot rename project because it contains container registry tags!'))
-      end
-
       validate_default_branch_change
+      validate_renaming_project_with_tags
     end
 
     def validate_default_branch_change
@@ -92,6 +89,28 @@ module Projects
       end
     end
 
+    def validate_renaming_project_with_tags
+      return unless renaming_project_with_container_registry_tags?
+
+      unless Feature.enabled?(:renaming_project_with_tags, project) &&
+          ContainerRegistry::GitlabApiClient.supports_gitlab_api?
+        raise ValidationError, s_('UpdateProject|Cannot rename project because it contains container registry tags!')
+      end
+
+      dry_run = ContainerRegistry::GitlabApiClient.rename_base_repository_path(
+        project.full_path, name: params[:path], dry_run: true)
+
+      return if dry_run == :accepted
+
+      log_error("Dry run failed for renaming project with tags: #{project.full_path}, error: #{dry_run}")
+      raise_validation_error(
+        format(
+          s_("UpdateProject|Cannot rename project, the container registry path rename validation failed: %{error}"),
+          error: dry_run.to_s.titleize
+        )
+      )
+    end
+
     def ambiguous_head_documentation_link
       url = Rails.application.routes.url_helpers.help_page_path('user/project/repository/branches/index', anchor: 'error-ambiguous-head-branch-exists')