Add latest changes from gitlab-org/gitlab@16-8-stable-eev16.8.0-rc42

12 files changed, 141 insertions, 38 deletions

diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index b29a172f5b1..721125749a5 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -987,11 +987,11 @@ RSpec.describe Projects::IssuesController, :request_store, feature_category: :te
         labels = create_list(:label, 10, project: project).map(&:to_reference)
         issue = create(:issue, project: project, description: 'Test issue')
 
-        control_count = ActiveRecord::QueryRecorder.new { issue.update!(description: [issue.description, label].join(' ')) }.count
+        control = ActiveRecord::QueryRecorder.new { issue.update!(description: [issue.description, label].join(' ')) }
 
         # Follow-up to get rid of this `2 * label.count` requirement: https://gitlab.com/gitlab-org/gitlab-foss/issues/52230
         expect { issue.update!(description: [issue.description, labels].join(' ')) }
-          .not_to exceed_query_limit(control_count + 2 * labels.count)
+          .not_to exceed_query_limit(control).with_threshold(2 * labels.count)
       end
 
       it 'logs the view with Gitlab::Search::RecentIssues' do
@@ -1849,15 +1849,17 @@ RSpec.describe Projects::IssuesController, :request_store, feature_category: :te
 
           RequestStore.clear!
 
-          control_count = ActiveRecord::QueryRecorder.new do
+          control = ActiveRecord::QueryRecorder.new do
             get :discussions, params: { namespace_id: project.namespace, project_id: project, id: issue.iid }
-          end.count
+          end
 
           RequestStore.clear!
 
           create_list(:discussion_note_on_issue, 2, :system, noteable: issue, project: issue.project, note: cross_reference)
 
-          expect { get :discussions, params: { namespace_id: project.namespace, project_id: project, id: issue.iid } }.not_to exceed_query_limit(control_count)
+          expect do
+            get :discussions, params: { namespace_id: project.namespace, project_id: project, id: issue.iid }
+          end.not_to exceed_query_limit(control)
         end
       end
 
diff --git a/spec/controllers/projects/labels_controller_spec.rb b/spec/controllers/projects/labels_controller_spec.rb
index db8cac8bb4a..2333ff0a937 100644
--- a/spec/controllers/projects/labels_controller_spec.rb
+++ b/spec/controllers/projects/labels_controller_spec.rb
@@ -108,7 +108,7 @@ RSpec.describe Projects::LabelsController, feature_category: :team_planning do
 
         # some n+1 queries still exist
         # calls to get max project authorization access level
-        expect { list_labels }.not_to exceed_all_query_limit(control.count).with_threshold(25)
+        expect { list_labels }.not_to exceed_all_query_limit(control).with_threshold(25)
         expect(assigns(:labels).count).to eq(10)
       end
     end
diff --git a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
index b2b591d7929..3c975c76337 100644
--- a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
@@ -138,10 +138,16 @@ RSpec.describe Projects::MergeRequests::DiffsController, feature_category: :code
   end
 
   let(:project) { create(:project, :repository) }
-  let(:user) { create(:user) }
   let(:maintainer) { true }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
 
+  let_it_be_with_reload(:user) { create(:user) }
+  let_it_be(:other_project) { create(:project) }
+
+  before_all do
+    other_project.add_maintainer(user)
+  end
+
   before do
     project.add_maintainer(user) if maintainer
     sign_in(user)
@@ -429,10 +435,7 @@ RSpec.describe Projects::MergeRequests::DiffsController, feature_category: :code
     end
 
     context 'when the merge request belongs to a different project' do
-      let(:other_project) { create(:project) }
-
       before do
-        other_project.add_maintainer(user)
         diff_for_path(old_path: existing_path, new_path: existing_path, project_id: other_project)
       end
 
@@ -442,6 +445,84 @@ RSpec.describe Projects::MergeRequests::DiffsController, feature_category: :code
     end
   end
 
+  describe 'GET diff_by_file_hash' do
+    def diff_by_file_hash(extra_params = {})
+      params = {
+        namespace_id: project.namespace.to_param,
+        project_id: project,
+        id: merge_request.iid,
+        format: 'json'
+      }
+
+      get :diff_by_file_hash, params: params.merge(extra_params)
+    end
+
+    let(:file) { merge_request.merge_request_diff.diffs.diff_files.first }
+    let(:file_hash) { file.file_hash }
+
+    context 'when the merge request exists' do
+      context 'when the user can view the merge request' do
+        context 'when the path exists in the diff' do
+          include_examples 'diff tracking' do
+            let(:method_call) { diff_by_file_hash(file_hash: file_hash) }
+          end
+
+          it 'enables diff notes' do
+            diff_by_file_hash(file_hash: file_hash)
+
+            expect(assigns(:diff_notes_disabled)).to be_falsey
+            expect(assigns(:new_diff_note_attrs)).to eq(
+              noteable_type: 'MergeRequest',
+              noteable_id: merge_request.id,
+              commit_id: nil
+            )
+          end
+
+          it 'only renders diff for the hash given' do
+            diff_by_file_hash(file_hash: file_hash)
+
+            diffs = json_response['diff_files']
+
+            expect(diffs.count).to eq(1)
+            expect(diffs.first['file_hash']).to eq(file_hash)
+          end
+        end
+      end
+
+      context 'when the user cannot view the merge request' do
+        let(:maintainer) { false }
+
+        before do
+          diff_by_file_hash(file_hash: file_hash)
+        end
+
+        it 'returns a 404' do
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'when the merge request does not exist' do
+      before do
+        diff_by_file_hash(id: merge_request.iid.succ, file_hash: file_hash)
+      end
+
+      it 'returns a 404' do
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+
+    context 'when the merge request belongs to a different project' do
+      before do
+        diff_by_file_hash(project_id: other_project, file_hash: file_hash)
+      end
+
+      it 'returns a 404' do
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+  end
+
   describe 'GET diffs_batch' do
     shared_examples_for 'serializes diffs with expected arguments' do
       it 'serializes paginated merge request diff collection' do
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index 55741a82862..d04cda240fa 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -244,6 +244,24 @@ RSpec.describe Projects::MergeRequestsController, feature_category: :code_review
           expect(response).to have_gitlab_http_status(:moved_permanently)
         end
       end
+
+      context 'when has pinned file' do
+        let(:file) { merge_request.merge_request_diff.diffs.diff_files.first }
+        let(:file_hash) { file.file_hash }
+
+        it 'adds pinned file url' do
+          go(pin: file_hash)
+
+          expect(assigns['pinned_file_url']).to eq(
+            diff_by_file_hash_namespace_project_merge_request_path(
+              format: 'json',
+              id: merge_request.iid,
+              namespace_id: project.namespace.to_param,
+              project_id: project.path,
+              file_hash: file_hash
+            ))
+        end
+      end
     end
 
     context 'when user is setting notes filters' do
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 678991b91a5..6b440b90f37 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -249,15 +249,15 @@ RSpec.describe Projects::NotesController, type: :controller, feature_category: :
 
         RequestStore.clear!
 
-        control_count = ActiveRecord::QueryRecorder.new do
+        control = ActiveRecord::QueryRecorder.new do
           get :index, params: request_params
-        end.count
+        end
 
         RequestStore.clear!
 
         create_list(:discussion_note_on_issue, 2, :system, noteable: issue, project: issue.project, note: cross_reference)
 
-        expect { get :index, params: request_params }.not_to exceed_query_limit(control_count)
+        expect { get :index, params: request_params }.not_to exceed_query_limit(control)
       end
     end
   end
diff --git a/spec/controllers/projects/packages/infrastructure_registry_controller_spec.rb b/spec/controllers/projects/packages/infrastructure_registry_controller_spec.rb
index fc741d0f3f6..292c4017d8e 100644
--- a/spec/controllers/projects/packages/infrastructure_registry_controller_spec.rb
+++ b/spec/controllers/projects/packages/infrastructure_registry_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Projects::Packages::InfrastructureRegistryController do
+RSpec.describe Projects::Packages::InfrastructureRegistryController, feature_category: :package_registry do
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :private) }
 
diff --git a/spec/controllers/projects/packages/packages_controller_spec.rb b/spec/controllers/projects/packages/packages_controller_spec.rb
index da9cae47c62..8570af075ad 100644
--- a/spec/controllers/projects/packages/packages_controller_spec.rb
+++ b/spec/controllers/projects/packages/packages_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Projects::Packages::PackagesController do
+RSpec.describe Projects::Packages::PackagesController, feature_category: :package_registry do
   let_it_be(:project) { create(:project, :public) }
 
   let(:page) { :index }
diff --git a/spec/controllers/projects/pipeline_schedules_controller_spec.rb b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
index 7cd4f43d4da..9fe2e4c23e0 100644
--- a/spec/controllers/projects/pipeline_schedules_controller_spec.rb
+++ b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
@@ -108,11 +108,11 @@ RSpec.describe Projects::PipelineSchedulesController, feature_category: :continu
     end
 
     it 'avoids N + 1 queries', :request_store do
-      control_count = ActiveRecord::QueryRecorder.new { visit_pipelines_schedules }.count
+      control = ActiveRecord::QueryRecorder.new { visit_pipelines_schedules }
 
       create_list(:ci_pipeline_schedule, 2, project: project)
 
-      expect { visit_pipelines_schedules }.not_to exceed_query_limit(control_count)
+      expect { visit_pipelines_schedules }.not_to exceed_query_limit(control)
     end
 
     context 'when the scope is set to active' do
diff --git a/spec/controllers/projects/pipelines_controller_spec.rb b/spec/controllers/projects/pipelines_controller_spec.rb
index deaed8e1162..82c1aa3e18c 100644
--- a/spec/controllers/projects/pipelines_controller_spec.rb
+++ b/spec/controllers/projects/pipelines_controller_spec.rb
@@ -381,7 +381,7 @@ RSpec.describe Projects::PipelinesController, feature_category: :continuous_inte
         # Set up all required variables
         get_pipeline_json
 
-        control_count = ActiveRecord::QueryRecorder.new { get_pipeline_json }.count
+        control = ActiveRecord::QueryRecorder.new { get_pipeline_json }
 
         first_build = pipeline.builds.first
         first_build.tag_list << [:hello, :world]
@@ -391,9 +391,7 @@ RSpec.describe Projects::PipelinesController, feature_category: :continuous_inte
         second_build.tag_list << [:docker, :ruby]
         create(:deployment, deployable: second_build)
 
-        new_count = ActiveRecord::QueryRecorder.new { get_pipeline_json }.count
-
-        expect(new_count).to be_within(1).of(control_count)
+        expect { get_pipeline_json }.not_to exceed_query_limit(control).with_threshold(1)
       end
     end
 
@@ -1074,7 +1072,7 @@ RSpec.describe Projects::PipelinesController, feature_category: :continuous_inte
 
         clear_controller_memoization
 
-        control_count = ActiveRecord::QueryRecorder.new { get_test_report_json }.count
+        control = ActiveRecord::QueryRecorder.new { get_test_report_json }
 
         create(:ci_build, name: 'karma', pipeline: pipeline).tap do |build|
           create(:ci_job_artifact, :junit, job: build)
@@ -1082,7 +1080,7 @@ RSpec.describe Projects::PipelinesController, feature_category: :continuous_inte
 
         clear_controller_memoization
 
-        expect { get_test_report_json }.not_to exceed_query_limit(control_count)
+        expect { get_test_report_json }.not_to exceed_query_limit(control)
       end
     end
 
diff --git a/spec/controllers/projects/refs_controller_spec.rb b/spec/controllers/projects/refs_controller_spec.rb
index 345e6e2e0de..ab879d9aeb7 100644
--- a/spec/controllers/projects/refs_controller_spec.rb
+++ b/spec/controllers/projects/refs_controller_spec.rb
@@ -78,6 +78,23 @@ RSpec.describe Projects::RefsController, feature_category: :source_code_manageme
         expect(response).to have_gitlab_http_status(:bad_request)
       end
     end
+
+    context 'with an invalid path parameter' do
+      it 'returns 400 bad request' do
+        params = {
+          destination: 'graphs_commits',
+          namespace_id: project.namespace.to_param,
+          project_id: project,
+          id: 'master',
+          ref_type: nil,
+          path: '*'
+        }
+
+        get :switch, params: params
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
   end
 
   describe 'GET #logs_tree' do
diff --git a/spec/controllers/projects/security/configuration_controller_spec.rb b/spec/controllers/projects/security/configuration_controller_spec.rb
index 1ce0fcd85db..bfd269f9398 100644
--- a/spec/controllers/projects/security/configuration_controller_spec.rb
+++ b/spec/controllers/projects/security/configuration_controller_spec.rb
@@ -48,19 +48,6 @@ RSpec.describe Projects::Security::ConfigurationController do
         expect(sast_feature['available']).to be_truthy
         expect(dast_feature['available']).to be_falsey
       end
-
-      context 'with feature flag unify_security_configuration turned off' do
-        before do
-          stub_feature_flags(unify_security_configuration: false)
-        end
-
-        it 'responds with empty configuration data json' do
-          get :show, params: { namespace_id: project.namespace, project_id: project, format: :json }
-
-          expect(response).to have_gitlab_http_status(:ok)
-          expect(json_response).to be_empty
-        end
-      end
     end
   end
 end
diff --git a/spec/controllers/projects/starrers_controller_spec.rb b/spec/controllers/projects/starrers_controller_spec.rb
index 2148f495c31..236bb408d32 100644
--- a/spec/controllers/projects/starrers_controller_spec.rb
+++ b/spec/controllers/projects/starrers_controller_spec.rb
@@ -40,11 +40,11 @@ RSpec.describe Projects::StarrersController do
       it 'avoids N+1s loading users', :request_store do
         get_starrers
 
-        control_count = ActiveRecord::QueryRecorder.new { get_starrers }.count
+        control = ActiveRecord::QueryRecorder.new { get_starrers }
 
         create_list(:user, 5).each { |user| user.toggle_star(project) }
 
-        expect { get_starrers }.not_to exceed_query_limit(control_count)
+        expect { get_starrers }.not_to exceed_query_limit(control)
       end
     end