Add latest changes from gitlab-org/gitlab@master

7 files changed, 188 insertions, 64 deletions

diff --git a/spec/controllers/concerns/send_file_upload_spec.rb b/spec/controllers/concerns/send_file_upload_spec.rb
index 32304815bbb..55e4129e533 100644
--- a/spec/controllers/concerns/send_file_upload_spec.rb
+++ b/spec/controllers/concerns/send_file_upload_spec.rb
@@ -18,6 +18,12 @@ RSpec.describe SendFileUpload do
     end
   end
 
+  let(:cdn_uploader_class) do
+    Class.new(uploader_class) do
+      include ObjectStorage::CDN::Concern
+    end
+  end
+
   let(:controller_class) do
     Class.new do
       include SendFileUpload
@@ -269,5 +275,42 @@ RSpec.describe SendFileUpload do
 
       it_behaves_like 'handles image resize requests'
     end
+
+    context 'when CDN-enabled remote file is used' do
+      let(:uploader) { cdn_uploader_class.new(object, :file) }
+      let(:request) { instance_double('ActionDispatch::Request', remote_ip: '18.245.0.42') }
+      let(:signed_url) { 'https://cdn.example.org.test' }
+      let(:cdn_provider) { instance_double('ObjectStorage::CDN::GoogleCDN', signed_url: signed_url) }
+
+      before do
+        stub_uploads_object_storage(uploader: cdn_uploader_class)
+        uploader.object_store = ObjectStorage::Store::REMOTE
+        uploader.store!(temp_file)
+        allow(Gitlab.config.uploads.object_store).to receive(:proxy_download) { false }
+      end
+
+      context 'when use_cdn_with_job_artifacts_ui_downloads feature is enabled' do
+        it 'sends a file when CDN URL' do
+          expect(uploader).to receive(:use_cdn?).and_return(true)
+          expect(uploader).to receive(:cdn_provider).and_return(cdn_provider)
+          expect(controller).to receive(:request).and_return(request)
+          expect(controller).to receive(:redirect_to).with(signed_url)
+
+          subject
+        end
+      end
+
+      context 'when use_cdn_with_job_artifacts_ui_downloads is disabled' do
+        before do
+          stub_feature_flags(use_cdn_with_job_artifacts_ui_downloads: false)
+        end
+
+        it 'sends a file' do
+          expect(controller).to receive(:redirect_to).with(/#{uploader.path}/)
+
+          subject
+        end
+      end
+    end
   end
 end
diff --git a/spec/controllers/projects/artifacts_controller_spec.rb b/spec/controllers/projects/artifacts_controller_spec.rb
index 81c1d4acd36..8579d763ab0 100644
--- a/spec/controllers/projects/artifacts_controller_spec.rb
+++ b/spec/controllers/projects/artifacts_controller_spec.rb
@@ -153,8 +153,10 @@ RSpec.describe Projects::ArtifactsController do
         end
 
         context 'when file is stored remotely' do
+          let(:cdn_config) {}
+
           before do
-            stub_artifacts_object_storage
+            stub_artifacts_object_storage(cdn: cdn_config)
             create(:ci_job_artifact, :remote_store, :codequality, job: job)
           end
 
@@ -171,6 +173,45 @@ RSpec.describe Projects::ArtifactsController do
               download_artifact(file_type: file_type, proxy: true)
             end
           end
+
+          context 'when Google CDN is configured' do
+            let(:cdn_config) do
+              {
+                'provider' => 'Google',
+                'url' => 'https://cdn.example.org',
+                'key_name' => 'some-key',
+                'key' => Base64.urlsafe_encode64(SecureRandom.hex)
+              }
+            end
+
+            before do
+              allow(Gitlab::ApplicationContext).to receive(:push).and_call_original
+              request.env['action_dispatch.remote_ip'] = '18.245.0.42'
+            end
+
+            context 'with use_cdn_with_job_artifacts_ui_downloads enabled' do
+              it 'redirects to a Google CDN request' do
+                expect(Gitlab::ApplicationContext).to receive(:push).with(artifact_used_cdn: true).and_call_original
+
+                download_artifact(file_type: file_type)
+
+                expect(response.redirect_url).to start_with("https://cdn.example.org/")
+              end
+            end
+
+            context 'with use_cdn_with_job_artifacts_ui_downloads disabled' do
+              before do
+                stub_feature_flags(use_cdn_with_job_artifacts_ui_downloads: false)
+              end
+
+              it 'does not redirect to the CDN' do
+                download_artifact(file_type: file_type)
+
+                expect(response.redirect_url).to be_present
+                expect(response.redirect_url).not_to start_with("https://cdn.example.org/")
+              end
+            end
+          end
         end
       end
     end
diff --git a/spec/frontend/environments/environment_rollback_spec.js b/spec/frontend/environments/environment_rollback_spec.js
index be61c6fcc90..5d36209f8a6 100644
--- a/spec/frontend/environments/environment_rollback_spec.js
+++ b/spec/frontend/environments/environment_rollback_spec.js
@@ -76,7 +76,7 @@ describe('Rollback Component', () => {
 
     expect(apolloProvider.defaultClient.mutate).toHaveBeenCalledWith({
       mutation: setEnvironmentToRollback,
-      variables: { environment },
+      variables: { environment: { ...environment, isLastDeployment: true, retryUrl } },
     });
   });
 });
diff --git a/spec/frontend/environments/graphql/mock_data.js b/spec/frontend/environments/graphql/mock_data.js
index d246641b94b..355b77b55c3 100644
--- a/spec/frontend/environments/graphql/mock_data.js
+++ b/spec/frontend/environments/graphql/mock_data.js
@@ -537,6 +537,7 @@ export const folder = {
 
 export const resolvedEnvironment = {
   id: 41,
+  retryUrl: '/h5bp/html5-boilerplate/-/jobs/1014/retry',
   globalId: 'gid://gitlab/Environment/41',
   name: 'review/hello',
   state: 'available',
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index 470196ac1c5..65fbc8d9935 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -2866,58 +2866,6 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     end
   end
 
-  describe '#create_extension' do
-    subject { model.create_extension(extension) }
-
-    let(:extension) { :btree_gist }
-
-    it 'executes CREATE EXTENSION statement' do
-      expect(model).to receive(:execute).with(/CREATE EXTENSION IF NOT EXISTS #{extension}/)
-
-      subject
-    end
-
-    context 'without proper permissions' do
-      before do
-        allow(model).to receive(:execute)
-          .with(/CREATE EXTENSION IF NOT EXISTS #{extension}/)
-          .and_raise(ActiveRecord::StatementInvalid, 'InsufficientPrivilege: permission denied')
-      end
-
-      it 'raises an exception and prints an error message' do
-        expect { subject }
-          .to output(/user is not allowed/).to_stderr
-          .and raise_error(ActiveRecord::StatementInvalid, /InsufficientPrivilege/)
-      end
-    end
-  end
-
-  describe '#drop_extension' do
-    subject { model.drop_extension(extension) }
-
-    let(:extension) { 'btree_gist' }
-
-    it 'executes CREATE EXTENSION statement' do
-      expect(model).to receive(:execute).with(/DROP EXTENSION IF EXISTS #{extension}/)
-
-      subject
-    end
-
-    context 'without proper permissions' do
-      before do
-        allow(model).to receive(:execute)
-          .with(/DROP EXTENSION IF EXISTS #{extension}/)
-          .and_raise(ActiveRecord::StatementInvalid, 'InsufficientPrivilege: permission denied')
-      end
-
-      it 'raises an exception and prints an error message' do
-        expect { subject }
-          .to output(/user is not allowed/).to_stderr
-          .and raise_error(ActiveRecord::StatementInvalid, /InsufficientPrivilege/)
-      end
-    end
-  end
-
   describe '#add_primary_key_using_index' do
     it "executes the statement to add the primary key" do
       expect(model).to receive(:execute).with /ALTER TABLE "test_table" ADD CONSTRAINT "old_name" PRIMARY KEY USING INDEX "new_name"/
diff --git a/spec/lib/gitlab/database/migrations/extension_helpers_spec.rb b/spec/lib/gitlab/database/migrations/extension_helpers_spec.rb
new file mode 100644
index 00000000000..fb29e06bc01
--- /dev/null
+++ b/spec/lib/gitlab/database/migrations/extension_helpers_spec.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Database::Migrations::ExtensionHelpers do
+  let(:model) do
+    ActiveRecord::Migration.new.extend(described_class)
+  end
+
+  before do
+    allow(model).to receive(:puts)
+  end
+
+  describe '#create_extension' do
+    subject { model.create_extension(extension) }
+
+    let(:extension) { :btree_gist }
+
+    it 'executes CREATE EXTENSION statement' do
+      expect(model).to receive(:execute).with(/CREATE EXTENSION IF NOT EXISTS #{extension}/)
+
+      subject
+    end
+
+    context 'without proper permissions' do
+      before do
+        allow(model).to receive(:execute)
+          .with(/CREATE EXTENSION IF NOT EXISTS #{extension}/)
+          .and_raise(ActiveRecord::StatementInvalid, 'InsufficientPrivilege: permission denied')
+      end
+
+      it 'raises an exception and prints an error message' do
+        expect { subject }
+          .to output(/user is not allowed/).to_stderr
+          .and raise_error(ActiveRecord::StatementInvalid, /InsufficientPrivilege/)
+      end
+    end
+  end
+
+  describe '#drop_extension' do
+    subject { model.drop_extension(extension) }
+
+    let(:extension) { 'btree_gist' }
+
+    it 'executes CREATE EXTENSION statement' do
+      expect(model).to receive(:execute).with(/DROP EXTENSION IF EXISTS #{extension}/)
+
+      subject
+    end
+
+    context 'without proper permissions' do
+      before do
+        allow(model).to receive(:execute)
+          .with(/DROP EXTENSION IF EXISTS #{extension}/)
+          .and_raise(ActiveRecord::StatementInvalid, 'InsufficientPrivilege: permission denied')
+      end
+
+      it 'raises an exception and prints an error message' do
+        expect { subject }
+          .to output(/user is not allowed/).to_stderr
+          .and raise_error(ActiveRecord::StatementInvalid, /InsufficientPrivilege/)
+      end
+    end
+  end
+end
diff --git a/spec/uploaders/object_storage/cdn/google_cdn_spec.rb b/spec/uploaders/object_storage/cdn/google_cdn_spec.rb
index 8e209dabddc..96755b7292b 100644
--- a/spec/uploaders/object_storage/cdn/google_cdn_spec.rb
+++ b/spec/uploaders/object_storage/cdn/google_cdn_spec.rb
@@ -92,26 +92,52 @@ RSpec.describe ObjectStorage::CDN::GoogleCDN,
     end
   end
 
-  describe '#signed_url' do
+  describe '#signed_url', :freeze_time do
     let(:path) { '/path/to/file.txt' }
+    let(:expiration) { (Time.current + 10.minutes).utc.to_i }
+    let(:cdn_query_params) { "Expires=#{expiration}&KeyName=#{key_name}" }
 
-    it 'returns a valid signed URL' do
-      url = subject.signed_url(path)
-
+    def verify_signature(url, unsigned_url)
       expect(url).to start_with("#{options[:url]}#{path}")
 
       uri = Addressable::URI.parse(url)
-      parsed_query = Rack::Utils.parse_nested_query(uri.query)
-      signature = parsed_query.delete('Signature')
+      query = uri.query_values
+      signature = query['Signature']
 
-      signed_url = "#{options[:url]}#{path}?Expires=#{parsed_query['Expires']}&KeyName=#{key_name}"
-      computed_signature = OpenSSL::HMAC.digest('SHA1', key, signed_url)
+      computed_signature = OpenSSL::HMAC.digest('SHA1', key, unsigned_url)
 
       aggregate_failures do
-        expect(parsed_query['Expires'].to_i).to be > 0
-        expect(parsed_query['KeyName']).to eq(key_name)
+        expect(query['Expires'].to_i).to be > 0
+        expect(query['KeyName']).to eq(key_name)
         expect(signature).to eq(Base64.urlsafe_encode64(computed_signature))
       end
     end
+
+    context 'with default query parameters' do
+      let(:url) { subject.signed_url(path) }
+      let(:unsigned_url) { "#{options[:url]}#{path}?#{cdn_query_params}" }
+
+      it 'returns a valid signed URL' do
+        verify_signature(url, unsigned_url)
+      end
+    end
+
+    context 'with nil query parameters' do
+      let(:url) { subject.signed_url(path, params: nil) }
+      let(:unsigned_url) { "#{options[:url]}#{path}?#{cdn_query_params}" }
+
+      it 'returns a valid signed URL' do
+        verify_signature(url, unsigned_url)
+      end
+    end
+
+    context 'with extra query parameters' do
+      let(:url) { subject.signed_url(path, params: { 'response-content-type' => 'text/plain' }) }
+      let(:unsigned_url) { "#{options[:url]}#{path}?response-content-type=text%2Fplain&#{cdn_query_params}" }
+
+      it 'returns a valid signed URL' do
+        verify_signature(url, unsigned_url)
+      end
+    end
   end
 end