Add latest changes from gitlab-org/gitlab@master

7 files changed, 132 insertions, 27 deletions

diff --git a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
index 89a75fb53f2..475f857a102 100644
--- a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
+++ b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::DependencyProxyForContainersController do
+RSpec.describe Groups::DependencyProxyForContainersController, feature_category: :dependency_proxy do
   include HttpBasicAuthHelpers
   include DependencyProxyHelpers
   include WorkhorseHelpers
@@ -249,7 +249,7 @@ RSpec.describe Groups::DependencyProxyForContainersController do
             expect(send_data_type).to eq('send-dependency')
             expect(header).to eq(
               "Authorization" => ["Bearer abcd1234"],
-              "Accept" => ::DependencyProxy::Manifest::ACCEPTED_TYPES
+              "Accept" => ::DependencyProxy::Manifest::ACCEPTED_TYPES + [ContainerRegistry::BaseClient::DOCKER_DISTRIBUTION_MANIFEST_LIST_V2_TYPE]
             )
             expect(url).to eq(DependencyProxy::Registry.manifest_url(image, tag))
             expect(response.headers['Content-Type']).to eq('application/gzip')
@@ -257,6 +257,21 @@ RSpec.describe Groups::DependencyProxyForContainersController do
               ActionDispatch::Http::ContentDisposition.format(disposition: 'attachment', filename: manifest.file_name)
             )
           end
+
+          context 'when add_docker_distribution_manifest_list_v2_type_to_accept_header disabled' do
+            before do
+              stub_feature_flags(add_docker_distribution_manifest_list_v2_type_to_accept_header: false)
+            end
+
+            it 'returns `Accept` header without docker manifest list v2' do
+              subject
+
+              _send_data_type, send_data = workhorse_send_data
+              header = send_data['Header']
+
+              expect(header['Accept']).to eq(::DependencyProxy::Manifest::ACCEPTED_TYPES)
+            end
+          end
         end
       end
 
diff --git a/spec/features/projects/settings/packages_settings_spec.rb b/spec/features/projects/settings/packages_settings_spec.rb
index 564a71e9a23..5277ede8e52 100644
--- a/spec/features/projects/settings/packages_settings_spec.rb
+++ b/spec/features/projects/settings/packages_settings_spec.rb
@@ -35,7 +35,7 @@ RSpec.describe 'Projects > Settings > Packages', :js, feature_category: :groups_
     let(:packages_enabled) { false }
 
     it 'does not show up in UI' do
-      expect(page).not_to have_selector('[data-testid="toggle-label"]', text: 'Packages')
+      expect(page).not_to have_selector('[data-testid="toggle-label"]', text: 'Package registry')
     end
   end
 end
diff --git a/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js b/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
index a623f494cec..8b672ff3f32 100644
--- a/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
+++ b/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
@@ -519,26 +519,34 @@ describe('Settings Panel', () => {
     });
 
     it.each`
-      projectVisibilityLevel               | packageRegistryEnabled | packageRegistryApiForEveryoneEnabled | expectedAccessLevel
-      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${false}               | ${'disabled'}                        | ${featureAccessLevel.NOT_ENABLED}
-      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${true}                | ${false}                             | ${featureAccessLevel.PROJECT_MEMBERS}
-      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${true}                | ${true}                              | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
-      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${false}               | ${'disabled'}                        | ${featureAccessLevel.NOT_ENABLED}
-      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${true}                | ${false}                             | ${featureAccessLevel.EVERYONE}
-      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${true}                | ${true}                              | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
-      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${false}               | ${'hidden'}                          | ${featureAccessLevel.NOT_ENABLED}
-      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${true}                | ${'hidden'}                          | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
+      projectVisibilityLevel               | packageRegistryEnabled | packageRegistryAllowAnyoneToPullOption | packageRegistryApiForEveryoneEnabled | expectedAccessLevel
+      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${false}               | ${true}                                | ${'disabled'}                        | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${true}                | ${true}                                | ${false}                             | ${featureAccessLevel.PROJECT_MEMBERS}
+      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${true}                | ${true}                                | ${true}                              | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
+      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${false}               | ${true}                                | ${'disabled'}                        | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${true}                | ${true}                                | ${false}                             | ${featureAccessLevel.EVERYONE}
+      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${true}                | ${true}                                | ${true}                              | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
+      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${false}               | ${true}                                | ${'hidden'}                          | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${true}                | ${true}                                | ${'hidden'}                          | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
+      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${false}               | ${false}                               | ${'hidden'}                          | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_PRIVATE_INTEGER}  | ${true}                | ${false}                               | ${'hidden'}                          | ${featureAccessLevel.PROJECT_MEMBERS}
+      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${false}               | ${false}                               | ${'hidden'}                          | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_INTERNAL_INTEGER} | ${true}                | ${false}                               | ${'hidden'}                          | ${featureAccessLevel.EVERYONE}
+      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${false}               | ${false}                               | ${'hidden'}                          | ${featureAccessLevel.NOT_ENABLED}
+      ${VISIBILITY_LEVEL_PUBLIC_INTEGER}   | ${true}                | ${false}                               | ${'hidden'}                          | ${FEATURE_ACCESS_LEVEL_ANONYMOUS}
     `(
       'sets correct access level',
       async ({
         projectVisibilityLevel,
         packageRegistryEnabled,
+        packageRegistryAllowAnyoneToPullOption,
         packageRegistryApiForEveryoneEnabled,
         expectedAccessLevel,
       }) => {
         wrapper = mountComponent({
           packagesAvailable: true,
           currentSettings: {
+            packageRegistryAllowAnyoneToPullOption,
             visibilityLevel: projectVisibilityLevel,
           },
         });
diff --git a/spec/helpers/projects_helper_spec.rb b/spec/helpers/projects_helper_spec.rb
index f450f46fefc..c2fe99836f9 100644
--- a/spec/helpers/projects_helper_spec.rb
+++ b/spec/helpers/projects_helper_spec.rb
@@ -993,6 +993,7 @@ RSpec.describe ProjectsHelper, feature_category: :source_code_management do
 
       expect(settings).to include(
         packagesEnabled: !!project.packages_enabled,
+        packageRegistryAllowAnyoneToPullOption: ::Gitlab::CurrentSettings.package_registry_allow_anyone_to_pull_option,
         visibilityLevel: project.visibility_level,
         requestAccessEnabled: !!project.request_access_enabled,
         issuesAccessLevel: project.project_feature.issues_access_level,
diff --git a/spec/lib/container_registry/gitlab_api_client_spec.rb b/spec/lib/container_registry/gitlab_api_client_spec.rb
index ebc69201513..b53b5b44c2e 100644
--- a/spec/lib/container_registry/gitlab_api_client_spec.rb
+++ b/spec/lib/container_registry/gitlab_api_client_spec.rb
@@ -215,7 +215,6 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
   describe '#tags' do
     let(:path) { 'namespace/path/to/repository' }
     let(:page_size) { 100 }
-    let(:last) { nil }
     let(:response) do
       [
         {
@@ -235,7 +234,10 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
       ]
     end
 
-    subject { client.tags(path, page_size: page_size, last: last) }
+    let(:previous_page_url) { 'http://sandbox.org/test?before=b' }
+    let(:next_page_url) { 'http://sandbox.org/test?last=b' }
+
+    subject { client.tags(path, page_size: page_size) }
 
     context 'with valid parameters' do
       let(:expected) do
@@ -252,8 +254,7 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
       it { is_expected.to eq(expected) }
     end
 
-    context 'with a response with a link header' do
-      let(:next_page_url) { 'http://sandbox.org/test?last=b' }
+    context 'with a response with a link header containing next page' do
       let(:expected) do
         {
           pagination: { next: { uri: URI(next_page_url) } },
@@ -268,25 +269,38 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
       it { is_expected.to eq(expected) }
     end
 
-    context 'with a large page size set' do
-      let(:page_size) { described_class::MAX_TAGS_PAGE_SIZE + 1000 }
+    context 'with a response with a link header containing previous page' do
+      let(:expected) do
+        {
+          pagination: { previous: { uri: URI(previous_page_url) } },
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
 
+      before do
+        stub_tags(path, page_size: page_size, previous_page_url: previous_page_url, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with a response with a link header containing previous and next pages' do
       let(:expected) do
         {
-          pagination: {},
+          pagination: { previous: { uri: URI(previous_page_url) }, next: { uri: URI(next_page_url) } },
           response_body: ::Gitlab::Json.parse(response.to_json)
         }
       end
 
       before do
-        stub_tags(path, page_size: described_class::MAX_TAGS_PAGE_SIZE, respond_with: response)
+        stub_tags(path, page_size: page_size, previous_page_url: previous_page_url, next_page_url: next_page_url, respond_with: response)
       end
 
       it { is_expected.to eq(expected) }
     end
 
-    context 'with a last parameter set' do
-      let(:last) { 'test' }
+    context 'with a large page size set' do
+      let(:page_size) { described_class::MAX_TAGS_PAGE_SIZE + 1000 }
 
       let(:expected) do
         {
@@ -296,12 +310,41 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
       end
 
       before do
-        stub_tags(path, page_size: page_size, last: last, respond_with: response)
+        stub_tags(path, page_size: described_class::MAX_TAGS_PAGE_SIZE, respond_with: response)
       end
 
       it { is_expected.to eq(expected) }
     end
 
+    context 'with pagination parameters set' do
+      subject do
+        client.tags(path, page_size: page_size, last: last, before: before, name: name, sort: sort)
+      end
+
+      where(:last, :before, :name, :sort, :input) do
+        'test' | nil    | nil    | nil    | { last: 'test' }
+        nil    | 'test' | nil    | nil    | { before: 'test' }
+        nil    | nil    | 'test' | nil    | { name: 'test' }
+        nil    | nil    | nil    | 'asc'  | { sort: 'asc' }
+        'a'    | 'b'    | 'test' | 'desc' | { last: 'a', before: 'b', name: 'test', sort: 'desc' }
+      end
+
+      with_them do
+        let(:expected) do
+          {
+            pagination: {},
+            response_body: ::Gitlab::Json.parse(response.to_json)
+          }
+        end
+
+        before do
+          stub_tags(path, page_size: page_size, input: input, respond_with: response)
+        end
+
+        it { is_expected.to eq(expected) }
+      end
+    end
+
     context 'with non successful response' do
       before do
         stub_tags(path, page_size: page_size, status_code: 404)
@@ -829,8 +872,14 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
       .to_return(status: status_code, body: respond_with.to_json, headers: { 'Content-Type' => described_class::JSON_TYPE })
   end
 
-  def stub_tags(path, page_size: nil, last: nil, next_page_url: nil, status_code: 200, respond_with: {})
-    params = { n: page_size, last: last }.compact
+  def stub_tags(path, page_size: nil, input: {}, previous_page_url: nil, next_page_url: nil, status_code: 200, respond_with: {})
+    params = {
+      n: page_size,
+      last: input[:last],
+      name: input[:name],
+      sort: input[:sort],
+      before: input[:before]
+    }.compact
 
     url = "#{registry_api_url}/gitlab/v1/repositories/#{path}/tags/list/"
 
@@ -842,8 +891,12 @@ RSpec.describe ContainerRegistry::GitlabApiClient, feature_category: :container_
     request_headers['Authorization'] = "bearer #{token}" if token
 
     response_headers = { 'Content-Type' => described_class::JSON_TYPE }
-    if next_page_url
-      response_headers['Link'] = "<#{next_page_url}>; rel=\"next\""
+    if next_page_url || previous_page_url
+      previous_page_url = %(<#{previous_page_url}>; rel="previous") if previous_page_url
+      next_page_url = %(<#{next_page_url}>; rel="next") if next_page_url
+
+      link_header = [previous_page_url, next_page_url].compact.join(" ,")
+      response_headers['Link'] = link_header
     end
 
     stub_request(:get, url)
diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb
index 076836cfcef..467159a0ec0 100644
--- a/spec/models/application_setting_spec.rb
+++ b/spec/models/application_setting_spec.rb
@@ -277,6 +277,9 @@ RSpec.describe ApplicationSetting, feature_category: :shared, type: :model do
     it { is_expected.to allow_values([true, false]).for(:instance_level_code_suggestions_enabled) }
     it { is_expected.not_to allow_value(nil).for(:instance_level_code_suggestions_enabled) }
 
+    it { is_expected.to allow_values([true, false]).for(:package_registry_allow_anyone_to_pull_option) }
+    it { is_expected.not_to allow_value(nil).for(:package_registry_allow_anyone_to_pull_option) }
+
     context 'when deactivate_dormant_users is enabled' do
       before do
         stub_application_setting(deactivate_dormant_users: true)
diff --git a/spec/policies/packages/policies/project_policy_spec.rb b/spec/policies/packages/policies/project_policy_spec.rb
index 5c267ff5ac5..fde10f64be8 100644
--- a/spec/policies/packages/policies/project_policy_spec.rb
+++ b/spec/policies/packages/policies/project_policy_spec.rb
@@ -127,5 +127,30 @@ RSpec.describe Packages::Policies::ProjectPolicy do
 
       it_behaves_like 'package access with repository disabled'
     end
+
+    context 'with package_registry_allow_anyone_to_pull_option disabled' do
+      where(:project, :expect_to_be_allowed) do
+        ref(:private_project)  | false
+        ref(:internal_project) | false
+        ref(:public_project)   | true
+      end
+
+      with_them do
+        let(:current_user) { anonymous }
+
+        before do
+          stub_application_setting(package_registry_allow_anyone_to_pull_option: false)
+          project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
+        end
+
+        it do
+          if expect_to_be_allowed
+            is_expected.to be_allowed(:read_package)
+          else
+            is_expected.to be_disallowed(:read_package)
+          end
+        end
+      end
+    end
   end
 end