Add latest changes from gitlab-org/gitlab@14-9-stable-eev14.9.0-rc42

4 files changed, 62 insertions, 20 deletions

diff --git a/lib/container_registry/client.rb b/lib/container_registry/client.rb
index add238350dd..4b2250d089d 100644
--- a/lib/container_registry/client.rb
+++ b/lib/container_registry/client.rb
@@ -10,6 +10,21 @@ module ContainerRegistry
     REGISTRY_FEATURES_HEADER = 'gitlab-container-registry-features'
     REGISTRY_TAG_DELETE_FEATURE = 'tag_delete'
 
+    ALLOWED_REDIRECT_SCHEMES = %w[http https].freeze
+    REDIRECT_OPTIONS = {
+      clear_authorization_header: true,
+      limit: 3,
+      cookies: [],
+      callback: -> (response_env, request_env) do
+        request_env.request_headers.delete(::FaradayMiddleware::FollowRedirects::AUTH_HEADER)
+
+        redirect_to = request_env.url
+        unless redirect_to.scheme.in?(ALLOWED_REDIRECT_SCHEMES)
+          raise ArgumentError, "Invalid scheme for #{redirect_to}"
+        end
+      end
+    }.freeze
+
     def self.supports_tag_delete?
       with_dummy_client(return_value_if_disabled: false) do |client|
         client.supports_tag_delete?
@@ -136,6 +151,10 @@ module ContainerRegistry
     def faraday_blob
       @faraday_blob ||= faraday_base do |conn|
         initialize_connection(conn, @options)
+
+        if Feature.enabled?(:container_registry_follow_redirects_middleware, default_enabled: :yaml)
+          conn.use ::FaradayMiddleware::FollowRedirects, REDIRECT_OPTIONS
+        end
       end
     end
   end
diff --git a/lib/container_registry/gitlab_api_client.rb b/lib/container_registry/gitlab_api_client.rb
index 20b8e1d419b..3cd7003d1f8 100644
--- a/lib/container_registry/gitlab_api_client.rb
+++ b/lib/container_registry/gitlab_api_client.rb
@@ -31,8 +31,10 @@ module ContainerRegistry
         registry_features = Gitlab::CurrentSettings.container_registry_features || []
         next true if ::Gitlab.com? && registry_features.include?(REGISTRY_GITLAB_V1_API_FEATURE)
 
-        response = faraday.get('/gitlab/v1/')
-        response.success? || response.status == 401
+        with_token_faraday do |faraday_client|
+          response = faraday_client.get('/gitlab/v1/')
+          response.success? || response.status == 401
+        end
       end
     end
 
@@ -50,15 +52,46 @@ module ContainerRegistry
 
     # https://gitlab.com/gitlab-org/container-registry/-/blob/master/docs-gitlab/api.md#get-repository-import-status
     def import_status(path)
-      body_hash = response_body(faraday.get(import_url_for(path)))
-      body_hash['status'] || 'error'
+      with_import_token_faraday do |faraday_client|
+        body_hash = response_body(faraday_client.get(import_url_for(path)))
+        body_hash['status'] || 'error'
+      end
+    end
+
+    def repository_details(path, with_size: false)
+      with_token_faraday do |faraday_client|
+        req = faraday_client.get("/gitlab/v1/repositories/#{path}/") do |req|
+          req.params['size'] = 'self' if with_size
+        end
+
+        break {} unless req.success?
+
+        response_body(req)
+      end
     end
 
     private
 
     def start_import_for(path, pre:)
-      faraday.put(import_url_for(path)) do |req|
-        req.params['pre'] = pre.to_s
+      with_import_token_faraday do |faraday_client|
+        faraday_client.put(import_url_for(path)) do |req|
+          req.params['import_type'] = pre ? 'pre' : 'final'
+        end
+      end
+    end
+
+    def with_token_faraday
+      yield faraday
+    end
+
+    def with_import_token_faraday
+      yield faraday_with_import_token
+    end
+
+    def faraday_with_import_token(timeout_enabled: true)
+      @faraday_with_import_token ||= faraday_base(timeout_enabled: timeout_enabled) do |conn|
+        # initialize the connection with the :import_token instead of :token
+        initialize_connection(conn, @options.merge(token: @options[:import_token]), &method(:configure_connection))
       end
     end
 
diff --git a/lib/container_registry/registry.rb b/lib/container_registry/registry.rb
index 710f8169a00..b377f7d0ac3 100644
--- a/lib/container_registry/registry.rb
+++ b/lib/container_registry/registry.rb
@@ -2,26 +2,16 @@
 
 module ContainerRegistry
   class Registry
-    include Gitlab::Utils::StrongMemoize
-
-    attr_reader :uri, :client, :path
+    attr_reader :uri, :client, :gitlab_api_client, :path
 
     def initialize(uri, options = {})
       @uri = uri
       @options = options
       @path = @options[:path] || default_path
       @client = ContainerRegistry::Client.new(@uri, @options)
-    end
-
-    def gitlab_api_client
-      strong_memoize(:gitlab_api_client) do
-        token = Auth::ContainerRegistryAuthenticationService.import_access_token
-
-        url = Gitlab.config.registry.api_url
-        host_port = Gitlab.config.registry.host_port
 
-        ContainerRegistry::GitlabApiClient.new(url, token: token, path: host_port)
-      end
+      import_token = Auth::ContainerRegistryAuthenticationService.import_access_token
+      @gitlab_api_client = ContainerRegistry::GitlabApiClient.new(@uri, @options.merge(import_token: import_token))
     end
 
     private
diff --git a/lib/container_registry/tag.rb b/lib/container_registry/tag.rb
index 2a32f950457..04a8e1d2e8f 100644
--- a/lib/container_registry/tag.rb
+++ b/lib/container_registry/tag.rb
@@ -104,7 +104,7 @@ module ContainerRegistry
     def total_size
       return unless layers
 
-      layers.map(&:size).sum if v2?
+      layers.sum(&:size) if v2?
     end
     # rubocop: enable CodeReuse/ActiveRecord