9 files changed, 124 insertions, 12 deletions
diff --git a/app/models/packages/debian.rb b/app/models/packages/debian.rb
index 2b8d0a4f51e..1fe4e28146e 100644
--- a/app/models/packages/debian.rb
+++ b/app/models/packages/debian.rb
@@ -4,13 +4,13 @@ module Packages
   module Debian
     TEMPORARY_PACKAGE_NAME = 'debian-temporary-package'
 
-    DISTRIBUTION_REGEX = %r{[a-z0-9][a-z0-9.-]*}i.freeze
+    DISTRIBUTION_REGEX = %r{[a-z0-9][a-z0-9.-]*}i
     COMPONENT_REGEX = DISTRIBUTION_REGEX.freeze
-    ARCHITECTURE_REGEX = %r{[a-z0-9][-a-z0-9]*}.freeze
+    ARCHITECTURE_REGEX = %r{[a-z0-9][-a-z0-9]*}
 
-    LETTER_REGEX = %r{(lib)?[a-z0-9]}.freeze
+    LETTER_REGEX = %r{(lib)?[a-z0-9]}
 
-    EMPTY_FILE_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'.freeze
+    EMPTY_FILE_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
 
     INCOMING_PACKAGE_NAME = 'incoming'
 
diff --git a/app/models/packages/debian/file_entry.rb b/app/models/packages/debian/file_entry.rb
index 7ea0dfe8765..4ac621dcbd4 100644
--- a/app/models/packages/debian/file_entry.rb
+++ b/app/models/packages/debian/file_entry.rb
@@ -6,7 +6,7 @@ module Packages
       include ActiveModel::Model
 
       DIGESTS = %i[md5 sha1 sha256].freeze
-      FILENAME_REGEX = %r{\A[a-zA-Z0-9][a-zA-Z0-9_.~+-]*\z}.freeze
+      FILENAME_REGEX = %r{\A[a-zA-Z0-9][a-zA-Z0-9_.~+-]*\z}
 
       attr_accessor :filename,
         :size,
diff --git a/app/models/packages/dependency_link.rb b/app/models/packages/dependency_link.rb
index 51018602bdc..400b4cce208 100644
--- a/app/models/packages/dependency_link.rb
+++ b/app/models/packages/dependency_link.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 class Packages::DependencyLink < ApplicationRecord
+  include EachBatch
+
   belongs_to :package, inverse_of: :dependency_links
   belongs_to :dependency, inverse_of: :dependency_links, class_name: 'Packages::Dependency'
   has_one :nuget_metadatum, inverse_of: :dependency_link, class_name: 'Packages::Nuget::DependencyLinkMetadatum'
@@ -14,6 +16,32 @@ class Packages::DependencyLink < ApplicationRecord
   scope :with_dependency_type, ->(dependency_type) { where(dependency_type: dependency_type) }
   scope :includes_dependency, -> { includes(:dependency) }
   scope :for_package, ->(package) { where(package_id: package.id) }
+  scope :for_packages, ->(packages) { where(package: packages) }
   scope :preload_dependency, -> { preload(:dependency) }
   scope :preload_nuget_metadatum, -> { preload(:nuget_metadatum) }
+  scope :select_dependency_id, -> { select(:dependency_id) }
+
+  def self.dependency_ids_grouped_by_type(packages)
+    inner_query = where(package_id: packages)
+                    .select('
+                      package_id,
+                      dependency_type,
+                      ARRAY_AGG(dependency_id) as dependency_ids
+                    ')
+                    .group(:package_id, :dependency_type)
+
+    cte = Gitlab::SQL::CTE.new(:dependency_links_cte, inner_query)
+    cte_alias = cte.table.alias(table_name)
+
+    with(cte.to_arel)
+      .select('
+        package_id,
+        JSON_OBJECT_AGG(
+          dependency_type,
+          dependency_ids
+      ) AS dependency_ids_by_type
+      ')
+      .from(cte_alias)
+      .group(:package_id)
+  end
 end
diff --git a/app/models/packages/ml_model/package.rb b/app/models/packages/ml_model/package.rb
new file mode 100644
index 00000000000..de2b5f8f2a8
--- /dev/null
+++ b/app/models/packages/ml_model/package.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Packages
+  module MlModel
+    class Package < Packages::Package
+      has_one :model_version, class_name: "Ml::ModelVersion", inverse_of: :package
+
+      validates :name,
+        format: Gitlab::Regex.ml_model_name_regex,
+        presence: true,
+        length: { maximum: 255 }
+
+      validates :version,
+        format: Gitlab::Regex.semver_regex,
+        presence: true,
+        length: { maximum: 255 }
+    end
+  end
+end
diff --git a/app/models/packages/nuget/metadatum.rb b/app/models/packages/nuget/metadatum.rb
index e7cf4528f16..1025af0fd24 100644
--- a/app/models/packages/nuget/metadatum.rb
+++ b/app/models/packages/nuget/metadatum.rb
@@ -15,8 +15,7 @@ class Packages::Nuget::Metadatum < ApplicationRecord
   validates :icon_url, public_url: { allow_blank: true }, length: { maximum: MAX_URL_LENGTH }
   validates :authors, presence: true, length: { maximum: MAX_AUTHORS_LENGTH }
   validates :description, presence: true, length: { maximum: MAX_DESCRIPTION_LENGTH }
-  validates :normalized_version, presence: true,
-    if: -> { Feature.enabled?(:nuget_normalized_version, package&.project) }
+  validates :normalized_version, presence: true
 
   validate :ensure_nuget_package_type
 
diff --git a/app/models/packages/nuget/symbol.rb b/app/models/packages/nuget/symbol.rb
new file mode 100644
index 00000000000..643b5552d84
--- /dev/null
+++ b/app/models/packages/nuget/symbol.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Packages
+  module Nuget
+    class Symbol < ApplicationRecord
+      include FileStoreMounter
+
+      belongs_to :package, -> { where(package_type: :nuget) }, inverse_of: :nuget_symbols
+
+      delegate :project_id, to: :package
+
+      validates :package, :file, :file_path, :signature, :object_storage_key, :size, presence: true
+      validates :signature, uniqueness: { scope: :file_path }
+      validates :object_storage_key, uniqueness: true
+
+      mount_file_store_uploader SymbolUploader
+
+      before_validation :set_object_storage_key, on: :create
+
+      private
+
+      def set_object_storage_key
+        return unless project_id && signature
+
+        self.object_storage_key = Gitlab::HashedPath.new(
+          'packages', 'nuget', package_id, 'symbols', OpenSSL::Digest::SHA256.hexdigest(signature),
+          root_hash: project_id
+        ).to_s
+      end
+    end
+  end
+end
diff --git a/app/models/packages/package.rb b/app/models/packages/package.rb
index b09911f4216..02e3908b3bf 100644
--- a/app/models/packages/package.rb
+++ b/app/models/packages/package.rb
@@ -7,6 +7,7 @@ class Packages::Package < ApplicationRecord
   include Gitlab::Utils::StrongMemoize
   include Packages::Installable
   include Packages::Downloadable
+  include EnumInheritance
 
   DISPLAYABLE_STATUSES = [:default, :error].freeze
   INSTALLABLE_STATUSES = [:default, :hidden].freeze
@@ -48,6 +49,7 @@ class Packages::Package < ApplicationRecord
   has_one :pypi_metadatum, inverse_of: :package, class_name: 'Packages::Pypi::Metadatum'
   has_one :maven_metadatum, inverse_of: :package, class_name: 'Packages::Maven::Metadatum'
   has_one :nuget_metadatum, inverse_of: :package, class_name: 'Packages::Nuget::Metadatum'
+  has_many :nuget_symbols, inverse_of: :package, class_name: 'Packages::Nuget::Symbol'
   has_one :composer_metadatum, inverse_of: :package, class_name: 'Packages::Composer::Metadatum'
   has_one :rubygems_metadatum, inverse_of: :package, class_name: 'Packages::Rubygems::Metadatum'
   has_one :rpm_metadatum, inverse_of: :package, class_name: 'Packages::Rpm::Metadatum'
@@ -179,11 +181,7 @@ class Packages::Package < ApplicationRecord
   scope :preload_conan_metadatum, -> { preload(:conan_metadatum) }
 
   scope :with_npm_scope, ->(scope) do
-    if Feature.enabled?(:npm_package_registry_fix_group_path_validation)
-      npm.where("position('/' in packages_packages.name) > 0 AND split_part(packages_packages.name, '/', 1) = :package_scope", package_scope: "@#{sanitize_sql_like(scope)}")
-    else
-      npm.where("name ILIKE :package_name", package_name: "@#{sanitize_sql_like(scope)}/%")
-    end
+    npm.where("position('/' in packages_packages.name) > 0 AND split_part(packages_packages.name, '/', 1) = :package_scope", package_scope: "@#{sanitize_sql_like(scope)}")
   end
 
   scope :without_nuget_temporary_name, -> { where.not(name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
@@ -220,6 +218,12 @@ class Packages::Package < ApplicationRecord
     joins(:project).reorder(keyset_order)
   end
 
+  def self.inheritance_column = 'package_type'
+
+  def self.inheritance_column_to_class_map = {
+    ml_model: 'Packages::MlModel::Package'
+  }.freeze
+
   def self.only_maven_packages_with_path(path, use_cte: false)
     if use_cte
       # This is an optimization fence which assumes that looking up the Metadatum record by path (globally)
diff --git a/app/models/packages/protection.rb b/app/models/packages/protection.rb
new file mode 100644
index 00000000000..ebaecf89992
--- /dev/null
+++ b/app/models/packages/protection.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Packages
+  module Protection
+    def self.table_name_prefix
+      'packages_protection_'
+    end
+  end
+end
diff --git a/app/models/packages/protection/rule.rb b/app/models/packages/protection/rule.rb
new file mode 100644
index 00000000000..bb65be92b90
--- /dev/null
+++ b/app/models/packages/protection/rule.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Packages
+  module Protection
+    class Rule < ApplicationRecord
+      enum package_type: Packages::Package.package_types.slice(:npm)
+
+      belongs_to :project, inverse_of: :package_protection_rules
+
+      validates :package_name_pattern, presence: true, uniqueness: { scope: [:project_id, :package_type] },
+        length: { maximum: 255 }
+      validates :package_type, presence: true
+      validates :push_protected_up_to_access_level, presence: true,
+        inclusion: { in: [
+          Gitlab::Access::DEVELOPER,
+          Gitlab::Access::MAINTAINER,
+          Gitlab::Access::OWNER
+        ] }
+    end
+  end
+end