Add latest changes from gitlab-org/gitlab@master

10 files changed, 186 insertions, 22 deletions

diff --git a/spec/fixtures/api/schemas/cluster_status.json b/spec/fixtures/api/schemas/cluster_status.json
index 6017ca9e2d5..ba97b7c82cb 100644
--- a/spec/fixtures/api/schemas/cluster_status.json
+++ b/spec/fixtures/api/schemas/cluster_status.json
@@ -38,6 +38,7 @@
         "email": { "type": ["string", "null"] },
         "stack": { "type": ["string", "null"] },
         "modsecurity_enabled": { "type": ["boolean", "null"] },
+        "modsecurity_mode": {"type": ["integer", "0"]},
         "update_available": { "type": ["boolean", "null"] },
         "can_uninstall": { "type": "boolean" },
         "available_domains": {
diff --git a/spec/frontend/clusters/components/ingress_modsecurity_settings_spec.js b/spec/frontend/clusters/components/ingress_modsecurity_settings_spec.js
index beb0721260b..0fc7a48f97a 100644
--- a/spec/frontend/clusters/components/ingress_modsecurity_settings_spec.js
+++ b/spec/frontend/clusters/components/ingress_modsecurity_settings_spec.js
@@ -1,7 +1,7 @@
 import { shallowMount } from '@vue/test-utils';
 import IngressModsecuritySettings from '~/clusters/components/ingress_modsecurity_settings.vue';
 import { APPLICATION_STATUS, INGRESS } from '~/clusters/constants';
-import { GlAlert, GlToggle } from '@gitlab/ui';
+import { GlAlert, GlToggle, GlDropdown } from '@gitlab/ui';
 import eventHub from '~/clusters/event_hub';
 
 const { UPDATING } = APPLICATION_STATUS;
@@ -13,6 +13,7 @@ describe('IngressModsecuritySettings', () => {
     modsecurity_enabled: false,
     status: 'installable',
     installed: false,
+    modsecurity_mode: 'logging',
   };
 
   const createComponent = (props = defaultProps) => {
@@ -29,6 +30,7 @@ describe('IngressModsecuritySettings', () => {
   const findSaveButton = () => wrapper.find('.btn-success');
   const findCancelButton = () => wrapper.find('[variant="secondary"]');
   const findModSecurityToggle = () => wrapper.find(GlToggle);
+  const findModSecurityDropdown = () => wrapper.find(GlDropdown);
 
   describe('when ingress is installed', () => {
     beforeEach(() => {
@@ -44,22 +46,50 @@ describe('IngressModsecuritySettings', () => {
     describe('with toggle changed by the user', () => {
       beforeEach(() => {
         findModSecurityToggle().vm.$emit('change');
+        wrapper.setProps({
+          ingress: {
+            ...defaultProps,
+            installed: true,
+            status: 'installed',
+            modsecurity_enabled: true,
+          },
+        });
       });
 
-      it('renders both save and cancel buttons', () => {
+      it('renders save and cancel buttons', () => {
         expect(findSaveButton().exists()).toBe(true);
         expect(findCancelButton().exists()).toBe(true);
       });
 
-      describe('and the save changes button is clicked', () => {
+      describe('with dropdown changed by the user', () => {
         beforeEach(() => {
-          findSaveButton().vm.$emit('click');
+          findModSecurityDropdown().vm.$children[1].$emit('click');
+          wrapper.setProps({
+            ingress: {
+              ...defaultProps,
+              installed: true,
+              status: 'installed',
+              modsecurity_enabled: true,
+              modsecurity_mode: 'blocking',
+            },
+          });
+        });
+
+        it('renders both save and cancel buttons', () => {
+          expect(findSaveButton().exists()).toBe(true);
+          expect(findCancelButton().exists()).toBe(true);
         });
 
-        it('triggers save event and pass current modsecurity value', () => {
-          expect(eventHub.$emit).toHaveBeenCalledWith('updateApplication', {
-            id: INGRESS,
-            params: { modsecurity_enabled: false },
+        describe('and the save changes button is clicked', () => {
+          beforeEach(() => {
+            findSaveButton().vm.$emit('click');
+          });
+
+          it('triggers save event and pass current modsecurity value', () => {
+            expect(eventHub.$emit).toHaveBeenCalledWith('updateApplication', {
+              id: INGRESS,
+              params: { modsecurity_enabled: true, modsecurity_mode: 'blocking' },
+            });
           });
         });
       });
@@ -70,7 +100,7 @@ describe('IngressModsecuritySettings', () => {
         });
 
         it('triggers reset event and hides both cancel and save changes button', () => {
-          expect(eventHub.$emit).toHaveBeenCalledWith('resetIngressModSecurityEnabled', INGRESS);
+          expect(eventHub.$emit).toHaveBeenCalledWith('resetIngressModSecurityChanges', INGRESS);
           expect(findSaveButton().exists()).toBe(false);
           expect(findCancelButton().exists()).toBe(false);
         });
diff --git a/spec/frontend/clusters/stores/clusters_store_spec.js b/spec/frontend/clusters/stores/clusters_store_spec.js
index d3775c6cfba..0207fda84c4 100644
--- a/spec/frontend/clusters/stores/clusters_store_spec.js
+++ b/spec/frontend/clusters/stores/clusters_store_spec.js
@@ -82,6 +82,7 @@ describe('Clusters Store', () => {
             externalHostname: null,
             installed: false,
             isEditingModSecurityEnabled: false,
+            isEditingModSecurityMode: false,
             installFailed: true,
             uninstallable: false,
             updateFailed: false,
@@ -89,6 +90,7 @@ describe('Clusters Store', () => {
             uninstallFailed: false,
             validationError: null,
             modsecurity_enabled: false,
+            modsecurity_mode: undefined,
           },
           runner: {
             title: 'GitLab Runner',
diff --git a/spec/graphql/types/snippet_type_spec.rb b/spec/graphql/types/snippet_type_spec.rb
index afac480d06b..ba0152ae983 100644
--- a/spec/graphql/types/snippet_type_spec.rb
+++ b/spec/graphql/types/snippet_type_spec.rb
@@ -3,12 +3,15 @@
 require 'spec_helper'
 
 describe GitlabSchema.types['Snippet'] do
+  let_it_be(:user) { create(:user) }
+
   it 'has the correct fields' do
     expected_fields = [:id, :title, :project, :author,
                        :file_name, :description,
                        :visibility_level, :created_at, :updated_at,
-                       :web_url, :raw_url, :notes, :discussions,
-                       :user_permissions, :description_html, :blob]
+                       :web_url, :raw_url, :ssh_url_to_repo, :http_url_to_repo,
+                       :notes, :discussions, :user_permissions,
+                       :description_html, :blob]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
   end
@@ -17,8 +20,55 @@ describe GitlabSchema.types['Snippet'] do
     it { expect(described_class).to require_graphql_authorizations(:read_snippet) }
   end
 
+  shared_examples 'response without repository URLs' do
+    it 'does not respond with repository URLs' do
+      expect(response['sshUrlToRepo']).to be_nil
+      expect(response['httpUrlToRepo']).to be_nil
+    end
+  end
+
+  describe 'Repository URLs' do
+    let(:query) do
+      %(
+        {
+          snippets {
+            nodes {
+              sshUrlToRepo
+              httpUrlToRepo
+            }
+          }
+        }
+      )
+    end
+    let(:response) { subject.dig('data', 'snippets', 'nodes')[0] }
+
+    subject { GitlabSchema.execute(query, context: { current_user: user }).as_json }
+
+    context 'when snippet has repository' do
+      let!(:snippet) { create(:personal_snippet, :repository, :public, author: user) }
+
+      it 'responds with repository URLs' do
+        expect(response['sshUrlToRepo']).to eq(snippet.ssh_url_to_repo)
+        expect(response['httpUrlToRepo']).to eq(snippet.http_url_to_repo)
+      end
+
+      context 'when version_snippets feature is disabled' do
+        before do
+          stub_feature_flags(version_snippets: false)
+        end
+
+        it_behaves_like 'response without repository URLs'
+      end
+    end
+
+    context 'when snippet does not have a repository' do
+      let!(:snippet) { create(:personal_snippet, :public, author: user) }
+
+      it_behaves_like 'response without repository URLs'
+    end
+  end
+
   describe '#blob' do
-    let_it_be(:user) { create(:user) }
     let(:query_blob) { subject.dig('data', 'snippets', 'edges')[0]['node']['blob'] }
     let(:query) do
       %(
diff --git a/spec/lib/gitlab/metrics/dashboard/processor_spec.rb b/spec/lib/gitlab/metrics/dashboard/processor_spec.rb
index e8860d50437..41693a991e0 100644
--- a/spec/lib/gitlab/metrics/dashboard/processor_spec.rb
+++ b/spec/lib/gitlab/metrics/dashboard/processor_spec.rb
@@ -74,6 +74,16 @@ describe Gitlab::Metrics::Dashboard::Processor do
         expect(actual_metrics_order).to eq expected_metrics_order
       end
 
+      context 'when the project has multiple metrics in the same group' do
+        let!(:project_response_metric) { create(:prometheus_metric, project: project, group: :response) }
+        let!(:project_response_metric_2) { create(:prometheus_metric, project: project, group: :response) }
+
+        it 'includes multiple metrics' do
+          expect(all_metrics).to include get_metric_details(project_response_metric)
+          expect(all_metrics).to include get_metric_details(project_response_metric_2)
+        end
+      end
+
       context 'when the dashboard should not include project metrics' do
         let(:sequence) do
           [
diff --git a/spec/models/clusters/applications/ingress_spec.rb b/spec/models/clusters/applications/ingress_spec.rb
index b1dd8ede3eb..ba5f48ce6b3 100644
--- a/spec/models/clusters/applications/ingress_spec.rb
+++ b/spec/models/clusters/applications/ingress_spec.rb
@@ -140,13 +140,10 @@ describe Clusters::Applications::Ingress do
   end
 
   describe '#values' do
-    let(:project) { build(:project) }
-    let(:cluster) { build(:cluster, projects: [project]) }
+    subject { ingress }
 
     context 'when modsecurity_enabled is enabled' do
       before do
-        allow(subject).to receive(:cluster).and_return(cluster)
-
         allow(subject).to receive(:modsecurity_enabled).and_return(true)
       end
 
@@ -154,8 +151,24 @@ describe Clusters::Applications::Ingress do
         expect(subject.values).to include("enable-modsecurity: 'true'")
       end
 
-      it 'includes modsecurity core ruleset enablement' do
-        expect(subject.values).to include("enable-owasp-modsecurity-crs: 'true'")
+      it 'includes modsecurity core ruleset enablement set to false' do
+        expect(subject.values).to include("enable-owasp-modsecurity-crs: 'false'")
+      end
+
+      it 'includes modsecurity snippet with information related to security rules' do
+        expect(subject.values).to include("SecRuleEngine DetectionOnly")
+        expect(subject.values).to include("Include #{described_class::MODSECURITY_OWASP_RULES_FILE}")
+      end
+
+      context 'when modsecurity_mode is set to :blocking' do
+        before do
+          subject.blocking!
+        end
+
+        it 'includes modsecurity snippet with information related to security rules' do
+          expect(subject.values).to include("SecRuleEngine On")
+          expect(subject.values).to include("Include #{described_class::MODSECURITY_OWASP_RULES_FILE}")
+        end
       end
 
       it 'includes modsecurity.conf content' do
@@ -176,7 +189,6 @@ describe Clusters::Applications::Ingress do
 
     context 'when modsecurity_enabled is disabled' do
       before do
-        allow(subject).to receive(:cluster).and_return(cluster)
         allow(subject).to receive(:modsecurity_enabled).and_return(false)
       end
 
diff --git a/spec/models/snippet_spec.rb b/spec/models/snippet_spec.rb
index 7ae4a81ddd7..533c10363ca 100644
--- a/spec/models/snippet_spec.rb
+++ b/spec/models/snippet_spec.rb
@@ -713,4 +713,32 @@ describe Snippet do
       it { is_expected.to eq(Gitlab.config.gitlab_shell.ssh_path_prefix + "#{snippet.project.full_path}/snippets/#{snippet.id}.git") }
     end
   end
+
+  describe '#versioned_enabled_for?' do
+    let_it_be(:user) { create(:user) }
+
+    subject { snippet.versioned_enabled_for?(user) }
+
+    context 'with repository and version_snippets enabled' do
+      let!(:snippet) { create(:personal_snippet, :repository, author: user) }
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'without repository' do
+      let!(:snippet) { create(:personal_snippet, author: user) }
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'without version_snippets feature disabled' do
+      let!(:snippet) { create(:personal_snippet, :repository, author: user) }
+
+      before do
+        stub_feature_flags(version_snippets: false)
+      end
+
+      it { is_expected.to be_falsy }
+    end
+  end
 end
diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index e018a4643db..8e2aed76913 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -85,7 +85,7 @@ describe API::ProjectSnippets do
 
   describe 'GET /projects/:project_id/snippets/:id' do
     let(:user) { create(:user) }
-    let(:snippet) { create(:project_snippet, :public, project: project) }
+    let(:snippet) { create(:project_snippet, :public, :repository, project: project) }
 
     it 'returns snippet json' do
       get api("/projects/#{project.id}/snippets/#{snippet.id}", user)
@@ -95,6 +95,18 @@ describe API::ProjectSnippets do
       expect(json_response['title']).to eq(snippet.title)
       expect(json_response['description']).to eq(snippet.description)
       expect(json_response['file_name']).to eq(snippet.file_name)
+      expect(json_response['ssh_url_to_repo']).to eq(snippet.ssh_url_to_repo)
+      expect(json_response['http_url_to_repo']).to eq(snippet.http_url_to_repo)
+    end
+
+    context 'when feature flag :version_snippets is disabled' do
+      before do
+        stub_feature_flags(version_snippets: false)
+
+        get api("/projects/#{project.id}/snippets/#{snippet.id}", user)
+      end
+
+      it_behaves_like 'snippet response without repository URLs'
     end
 
     it 'returns 404 for invalid snippet id' do
diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb
index 627611c10ce..865b0534cb0 100644
--- a/spec/requests/api/snippets_spec.rb
+++ b/spec/requests/api/snippets_spec.rb
@@ -139,8 +139,8 @@ describe API::Snippets do
   describe 'GET /snippets/:id' do
     let_it_be(:admin) { create(:user, :admin) }
     let_it_be(:author) { create(:user) }
-    let_it_be(:private_snippet) { create(:personal_snippet, :private, author: author) }
-    let_it_be(:internal_snippet) { create(:personal_snippet, :internal, author: author) }
+    let_it_be(:private_snippet) { create(:personal_snippet, :repository, :private, author: author) }
+    let_it_be(:internal_snippet) { create(:personal_snippet, :repository, :internal, author: author) }
 
     it 'requires authentication' do
       get api("/snippets/#{private_snippet.id}", nil)
@@ -157,6 +157,18 @@ describe API::Snippets do
       expect(json_response['description']).to eq(private_snippet.description)
       expect(json_response['file_name']).to eq(private_snippet.file_name)
       expect(json_response['visibility']).to eq(private_snippet.visibility)
+      expect(json_response['ssh_url_to_repo']).to eq(private_snippet.ssh_url_to_repo)
+      expect(json_response['http_url_to_repo']).to eq(private_snippet.http_url_to_repo)
+    end
+
+    context 'when feature flag :version_snippets is disabled' do
+      before do
+        stub_feature_flags(version_snippets: false)
+
+        get api("/snippets/#{private_snippet.id}", author)
+      end
+
+      it_behaves_like 'snippet response without repository URLs'
     end
 
     it 'shows private snippets to an admin' do
diff --git a/spec/support/shared_examples/requests/snippet_shared_examples.rb b/spec/support/shared_examples/requests/snippet_shared_examples.rb
index f2df97a35d9..aa7f57ae903 100644
--- a/spec/support/shared_examples/requests/snippet_shared_examples.rb
+++ b/spec/support/shared_examples/requests/snippet_shared_examples.rb
@@ -41,3 +41,10 @@ RSpec.shared_examples 'update with repository actions' do
     end
   end
 end
+
+RSpec.shared_examples 'snippet response without repository URLs' do
+  it 'skip inclusion of repository URLs' do
+    expect(json_response).not_to have_key('ssh_url_to_repo')
+    expect(json_response).not_to have_key('http_url_to_repo')
+  end
+end