3 files changed, 29 insertions, 0 deletions
diff --git a/app/services/labels/available_labels_service.rb b/app/services/labels/available_labels_service.rb
index ff29358df86..21f92eeaf09 100644
--- a/app/services/labels/available_labels_service.rb
+++ b/app/services/labels/available_labels_service.rb
@@ -40,6 +40,21 @@ module Labels
       ids.map(&:to_i) & existing_ids
     end
 
+    def filter_locked_labels_ids_in_param(key)
+      ids = Array.wrap(params[key])
+      return [] if ids.empty?
+
+      params = finder_params
+      params[:locked_labels] = true
+      existing_labels = LabelsFinder.new(current_user, params).execute
+
+      # rubocop:disable CodeReuse/ActiveRecord
+      existing_ids = existing_labels.id_in(ids).pluck(:id)
+      # rubocop:enable CodeReuse/ActiveRecord
+
+      ids.map(&:to_i) & existing_ids
+    end
+
     def available_labels
       @available_labels ||= LabelsFinder.new(current_user, finder_params).execute
     end
diff --git a/app/services/labels/create_service.rb b/app/services/labels/create_service.rb
index 6c070d15cdb..675439b2f64 100644
--- a/app/services/labels/create_service.rb
+++ b/app/services/labels/create_service.rb
@@ -13,6 +13,10 @@ module Labels
       project_or_group = target_params[:project] || target_params[:group]
 
       if project_or_group.present?
+        if Feature.disabled?(:enforce_locked_labels_on_merge, project_or_group, type: :ops)
+          params.delete(:lock_on_merge)
+        end
+
         project_or_group.labels.create(params)
       elsif target_params[:template]
         label = Label.new(params)
diff --git a/app/services/labels/update_service.rb b/app/services/labels/update_service.rb
index be33947d0eb..4ac54959e84 100644
--- a/app/services/labels/update_service.rb
+++ b/app/services/labels/update_service.rb
@@ -10,9 +10,19 @@ module Labels
     def execute(label)
       params[:name] = params.delete(:new_name) if params.key?(:new_name)
       params[:color] = convert_color_name_to_hex if params[:color].present?
+      params.delete(:lock_on_merge) unless allow_lock_on_merge?(label)
 
       label.update(params)
       label
     end
+
+    private
+
+    def allow_lock_on_merge?(label)
+      return if label.template?
+      return unless label.respond_to?(:parent_container)
+
+      Feature.enabled?(:enforce_locked_labels_on_merge, label.parent_container, type: :ops)
+    end
   end
 end