Add latest changes from gitlab-org/gitlab@master

12 files changed, 108 insertions, 23 deletions

diff --git a/app/assets/javascripts/ci/ci_variable_list/components/ci_variable_drawer.vue b/app/assets/javascripts/ci/ci_variable_list/components/ci_variable_drawer.vue
index 5b2984e5249..a32c5f476fb 100644
--- a/app/assets/javascripts/ci/ci_variable_list/components/ci_variable_drawer.vue
+++ b/app/assets/javascripts/ci/ci_variable_list/components/ci_variable_drawer.vue
@@ -427,6 +427,7 @@ export default {
           variant="confirm"
           :disabled="!canSubmit"
           data-testid="ci-variable-confirm-btn"
+          data-qa-selector="ci_variable_save_button"
           @click="submit"
           >{{ modalActionText }}
         </gl-button>
diff --git a/app/assets/stylesheets/page_bundles/projects.scss b/app/assets/stylesheets/page_bundles/projects.scss
index 68139c55f5a..99c84026762 100644
--- a/app/assets/stylesheets/page_bundles/projects.scss
+++ b/app/assets/stylesheets/page_bundles/projects.scss
@@ -43,7 +43,7 @@
     &.static-namespace {
       height: 35px;
       border-radius: 3px;
-      border: 1px solid $border-color;
+      border: 1px solid var(--border-color, $border-color);
       max-width: 100%;
       flex-grow: 1;
     }
@@ -57,7 +57,7 @@
 .save-project-loader {
   margin-top: 50px;
   margin-bottom: 50px;
-  color: $gray-700;
+  color: var(--gray-700, $gray-700);
 }
 
 .deploy-key {
@@ -87,23 +87,23 @@
 }
 
 .vs-public {
-  color: $blue-500;
+  color: var(--blue-500, $blue-500);
 }
 
 .vs-internal {
-  color: $orange-500;
+  color: var(--orange-500, $orange-500);
 }
 
 .vs-private {
-  color: $green-500;
+  color: var(--green-500, $green-500);
 }
 
 .lfs-enabled {
-  color: $green-500;
+  color: var(--green-500, $green-500);
 }
 
 .lfs-disabled {
-  color: $orange-500;
+  color: var(--orange-500, $orange-500);
 }
 
 .breadcrumb.repo-breadcrumb {
@@ -115,7 +115,7 @@
   margin: 0;
 
   a {
-    color: $gl-text-color;
+    color: var(--gl-text-color, $gl-text-color);
   }
 
   .dropdown-menu {
@@ -137,7 +137,7 @@
     padding: 16px 0;
 
     &:not(:first-child) {
-      border-top: 1px solid $border-color;
+      border-top: 1px solid var(--border-color, $border-color);
     }
 
     .controls {
@@ -168,7 +168,7 @@
 
     .input-group-text {
       width: 100%;
-      background-color: $white;
+      background-color: var(--white, $white);
     }
 
     .selected-icon {
@@ -237,7 +237,7 @@
 .repository-languages-bar {
   height: 8px;
   margin-bottom: $gl-padding;
-  background-color: $white;
+  background-color: var(--white, $white);
   border-radius: $border-radius-default;
 
   .progress-bar {
@@ -255,7 +255,7 @@
 }
 
 .repository-language-bar-tooltip-share {
-  color: $gray-200;
+  color: var(--gray-200, $gray-200);
 }
 
 /*
@@ -265,7 +265,7 @@
 .project-row {
   .description p {
     margin-bottom: 0;
-    color: $gl-text-color-secondary;
+    color: var(--gl-text-color-secondary, $gl-text-color-secondary);
     @include str-truncated(100%);
   }
 }
@@ -282,7 +282,7 @@
     @include gl-display-table-cell;
     @include gl-vertical-align-top;
     @include gl-py-4;
-    border-bottom: 1px solid $gray-50;
+    border-bottom: 1px solid var(--gray-50, $gray-50);
   }
 
   .project-row:last-of-type {
@@ -472,8 +472,8 @@
 
   .form-control {
     @include gl-font-monospace;
-    background-color: $white;
-    border-color: $border-color;
+    background-color: var(--white, $white);
+    border-color: var(--border-color, $border-color);
     font-size: 14px;
     margin-left: -1px;
     cursor: auto;
diff --git a/app/controllers/jwt_controller.rb b/app/controllers/jwt_controller.rb
index d299613f498..84ccfbc603a 100644
--- a/app/controllers/jwt_controller.rb
+++ b/app/controllers/jwt_controller.rb
@@ -87,13 +87,22 @@ class JwtController < ApplicationController
 
   # We have to parse scope here, because Docker Client does not send an array of scopes,
   # but rather a flat list and we loose second scope when being processed by Rails:
-  # scope=scopeA&scope=scopeB
+  # scope=scopeA&scope=scopeB.
+  #
+  # Additionally, according to RFC6749 (https://datatracker.ietf.org/doc/html/rfc6749#section-3.3), some clients may use
+  # a scope parameter expressed as a list of space-delimited elements. Therefore, we must account for this and split the
+  # scope parameter value(s) appropriately.
   #
   # This method makes to always return an array of scopes
   def scopes_param
     return unless params[:scope].present?
 
-    Array(Rack::Utils.parse_query(request.query_string)['scope'])
+    scopes = Array(Rack::Utils.parse_query(request.query_string)['scope'])
+    if Feature.enabled?(:jwt_auth_space_delimited_scopes, Feature.current_request)
+      scopes.flat_map(&:split)
+    else
+      scopes
+    end
   end
 
   def auth_user
diff --git a/app/graphql/mutations/packages/protection/rule/create.rb b/app/graphql/mutations/packages/protection/rule/create.rb
index 2b8b18c5b30..36eaec334d6 100644
--- a/app/graphql/mutations/packages/protection/rule/create.rb
+++ b/app/graphql/mutations/packages/protection/rule/create.rb
@@ -48,7 +48,8 @@ module Mutations
               raise_resource_not_available_error!("'packages_protected_packages' feature flag is disabled")
             end
 
-            response = ::Packages::Protection::CreateRuleService.new(project, current_user, kwargs).execute
+            response = ::Packages::Protection::CreateRuleService.new(project: project, current_user: current_user,
+              params: kwargs).execute
 
             { package_protection_rule: response.payload[:package_protection_rule], errors: response.errors }
           end
diff --git a/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb b/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
index 16c39266b59..71833fbd2b9 100644
--- a/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
+++ b/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
@@ -49,7 +49,8 @@ module WorkItems
         {
           project: [:project_feature, :group]
         },
-        :author
+        :author,
+        *super
       ]
     end
   end
diff --git a/app/graphql/resolvers/work_items/ancestors_resolver.rb b/app/graphql/resolvers/work_items/ancestors_resolver.rb
new file mode 100644
index 00000000000..33adbfc9c86
--- /dev/null
+++ b/app/graphql/resolvers/work_items/ancestors_resolver.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Resolvers
+  module WorkItems
+    class AncestorsResolver < BaseResolver
+      prepend ::WorkItems::LookAheadPreloads
+
+      type Types::WorkItemType.connection_type, null: true
+
+      def resolve_with_lookahead
+        ancestors = object.ancestors
+        return WorkItem.none unless ancestors
+
+        truncate_ancestors(apply_lookahead(ancestors)).reverse!
+      end
+
+      private
+
+      def truncate_ancestors(ancestors)
+        # Iterate from closest ancestor until root or first missing ancestor
+        authorized = authorized_ancestors(ancestors)
+
+        previous_ancestor = object.work_item
+        authorized.take_while do |ancestor|
+          is_direct_parent = previous_ancestor.work_item_parent.id == ancestor.id
+          previous_ancestor = ancestor
+
+          is_direct_parent
+        end
+      end
+
+      def authorized_ancestors(ancestors)
+        preload_resource_parents(ancestors)
+
+        DeclarativePolicy.user_scope do
+          ancestors.select { |ancestor| Ability.allowed?(current_user, :read_work_item, ancestor) }
+        end
+      end
+
+      def preload_resource_parents(work_items)
+        projects = work_items.filter_map(&:project)
+        namespaces = work_items.filter_map(&:namespace)
+        group_namespaces = namespaces.select { |n| n.type == ::Group.sti_name }
+
+        ::Preloaders::GroupPolicyPreloader.new(group_namespaces, current_user).execute if group_namespaces.any?
+        return unless projects.any?
+
+        ::Preloaders::UserMaxAccessLevelInProjectsPreloader.new(projects, current_user).execute
+        ::Preloaders::GroupPolicyPreloader.new(projects.filter_map(&:namespace), current_user).execute
+        ActiveRecord::Associations::Preloader.new(records: projects, associations: [:namespace]).call
+      end
+
+      def unconditional_includes
+        [:namespace, :work_item_parent, :work_item_type]
+      end
+    end
+  end
+end
diff --git a/app/graphql/types/packages/package_base_type.rb b/app/graphql/types/packages/package_base_type.rb
index cc41169bcda..aa580d48709 100644
--- a/app/graphql/types/packages/package_base_type.rb
+++ b/app/graphql/types/packages/package_base_type.rb
@@ -23,6 +23,7 @@ module Types
       field :package_type, Types::Packages::PackageTypeEnum, null: false, description: 'Package type.'
       field :project, Types::ProjectType, null: false, description: 'Project where the package is stored.'
       field :status, Types::Packages::PackageStatusEnum, null: false, description: 'Package status.'
+      field :status_message, GraphQL::Types::String, null: true, description: 'Status message.'
       field :tags, Types::Packages::PackageTagType.connection_type, null: true, description: 'Package tags.'
       field :updated_at, Types::TimeType, null: false, description: 'Date of most recent update.'
       field :version, GraphQL::Types::String, null: true, description: 'Version string.'
diff --git a/app/graphql/types/work_items/widgets/hierarchy_type.rb b/app/graphql/types/work_items/widgets/hierarchy_type.rb
index 4ec8ec84779..41c5af2ce63 100644
--- a/app/graphql/types/work_items/widgets/hierarchy_type.rb
+++ b/app/graphql/types/work_items/widgets/hierarchy_type.rb
@@ -20,6 +20,12 @@ module Types
           null: true, complexity: 5,
           description: 'Child work items.'
 
+        field :ancestors, ::Types::WorkItemType.connection_type,
+          null: true, complexity: 5,
+          description: 'Ancestors (parents) of the work item.',
+          extras: [:lookahead],
+          resolver: Resolvers::WorkItems::AncestorsResolver
+
         field :has_children, GraphQL::Types::Boolean,
               null: false, description: 'Indicates if the work item has children.'
 
diff --git a/app/models/integrations/jira.rb b/app/models/integrations/jira.rb
index a08f826ed23..f6e99454cb1 100644
--- a/app/models/integrations/jira.rb
+++ b/app/models/integrations/jira.rb
@@ -394,6 +394,10 @@ module Integrations
       jira_auth_type == AUTH_TYPE_PAT
     end
 
+    def avatar_url
+      ActionController::Base.helpers.image_path('illustrations/third-party-logos/integrations-logos/jira.svg')
+    end
+
     private
 
     def jira_issue_match_regex
diff --git a/app/models/work_items/widgets/hierarchy.rb b/app/models/work_items/widgets/hierarchy.rb
index 9d90a56d59e..fc6714f1e08 100644
--- a/app/models/work_items/widgets/hierarchy.rb
+++ b/app/models/work_items/widgets/hierarchy.rb
@@ -11,6 +11,10 @@ module WorkItems
         work_item.work_item_children_by_relative_position
       end
 
+      def ancestors
+        work_item.ancestors
+      end
+
       def self.quick_action_commands
         [:set_parent, :add_child]
       end
diff --git a/app/services/packages/protection/create_rule_service.rb b/app/services/packages/protection/create_rule_service.rb
index f0bd7f3d900..e69eb8faf60 100644
--- a/app/services/packages/protection/create_rule_service.rb
+++ b/app/services/packages/protection/create_rule_service.rb
@@ -2,7 +2,7 @@
 
 module Packages
   module Protection
-    class CreateRuleService < BaseService
+    class CreateRuleService < BaseProjectService
       ALLOWED_ATTRIBUTES = %i[
         package_name_pattern
         package_type
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index f863fbd296f..1392c7ab89f 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -92,11 +92,11 @@
           - if is_merge_request && !moved_sidebar_enabled
             .sub-block.js-sidebar-source-branch
               .sidebar-collapsed-icon.js-dont-change-state
-                = deprecated_clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport', class: 'btn-clipboard gl-button btn-default-tertiary btn-icon btn-sm js-source-branch-copy')
+                = clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport', class: 'js-source-branch-copy')
               .gl-display-flex.gl-align-items-center.gl-justify-content-space-between.gl-mb-2.hide-collapsed
                 %span.gl-overflow-hidden.gl-text-overflow-ellipsis.gl-white-space-nowrap
                   = _('Source branch: %{source_branch_open}%{source_branch}%{source_branch_close}').html_safe % { source_branch_open: "<span class='gl-font-monospace' data-testid='ref-name' title='#{html_escape(source_branch)}'>".html_safe, source_branch_close: "</span>".html_safe, source_branch: html_escape(source_branch) }
-                = deprecated_clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport', class: 'btn-clipboard gl-button btn-default-tertiary btn-icon btn-sm js-source-branch-copy')
+                = clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport', class: 'js-source-branch-copy')
 
       - if show_forwarding_email && !moved_sidebar_enabled
         .block