Merge remote-tracking branch 'upstream/master' into artifacts-from-ref-and-build-name

* upstream/master: (195 commits)
  Fix expansion of discussions in diff
  Improve performance of MR show page
  Fix jumping between discussions on changes tab
  Update doorkeeper to 4.2.0
  Fix MR note discussion ID
  Handle legacy sort order values
  Refactor `find_for_git_client` and its related methods.
  Remove right margin on Jump button icon
  Fix bug causing “Jump to discussion” button not to show
  Small refactor and syntax fixes.
  Removed unnecessary service for user retrieval and improved API error message.
  Added documentation and CHANGELOG item
  Added checks for 2FA to the API `/sessions` endpoint and the Resource Owner Password Credentials flow.
  Fix behavior around commands with optional arguments
  Fix behavior of label_ids and add/remove_label_ids
  Remove unneeded aliases
  Do not expose projects on deployments
  Incorporate feedback
  Docs for API endpoints
  Expose project for environments
  ...

3 files changed, 14 insertions, 1 deletions

diff --git a/config/application.rb b/config/application.rb
index 0c136623477..6b80f8ddafa 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -85,6 +85,7 @@ module Gitlab
     config.assets.precompile << "users/users_bundle.js"
     config.assets.precompile << "network/network_bundle.js"
     config.assets.precompile << "profile/profile_bundle.js"
+    config.assets.precompile << "diff_notes/diff_notes_bundle.js"
     config.assets.precompile << "boards/boards_bundle.js"
     config.assets.precompile << "boards/test_utils/simulate_drag.js"
     config.assets.precompile << "lib/utils/*.js"
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb
index 618dba74151..fc4b0a72add 100644
--- a/config/initializers/doorkeeper.rb
+++ b/config/initializers/doorkeeper.rb
@@ -12,7 +12,8 @@ Doorkeeper.configure do
   end
 
   resource_owner_from_credentials do |routes|
-    Gitlab::Auth.find_with_user_password(params[:username], params[:password])
+    user = Gitlab::Auth.find_with_user_password(params[:username], params[:password])
+    user unless user.try(:two_factor_enabled?)
   end
 
   # If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below.
diff --git a/config/routes.rb b/config/routes.rb
index 7fc59aadd55..606181ff837 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -375,6 +375,8 @@ Rails.application.routes.draw do
           patch :skip
         end
       end
+
+      resources :u2f_registrations, only: [:destroy]
     end
   end
 
@@ -747,6 +749,13 @@ Rails.application.routes.draw do
             get :update_branches
             get :diff_for_path
           end
+
+          resources :discussions, only: [], constraints: { id: /\h{40}/ } do
+            member do
+              post :resolve
+              delete :resolve, action: :unresolve
+            end
+          end
         end
 
         resources :branches, only: [:index, :new, :create, :destroy], constraints: { id: Gitlab::Regex.git_reference_regex }
@@ -865,6 +874,8 @@ Rails.application.routes.draw do
           member do
             post :toggle_award_emoji
             delete :delete_attachment
+            post :resolve
+            delete :resolve, action: :unresolve
           end
         end