Backport from EE !5954

Allow Labels::FindOrCreateService to find ancestor group labels
Add authentication check on API endpoint
Update flayignore

.flayignore

 *.erb
 lib/gitlab/sanitizers/svg/whitelist.rb
 lib/gitlab/diff/position_tracer.rb
+app/controllers/projects/approver_groups_controller.rb
+app/controllers/projects/approvers_controller.rb
+app/controllers/projects/protected_branches/merge_access_levels_controller.rb
+app/controllers/projects/protected_branches/push_access_levels_controller.rb
+app/controllers/projects/protected_tags/create_access_levels_controller.rb
 app/policies/project_policy.rb
 app/models/concerns/relative_positioning.rb
 app/workers/stuck_merge_jobs_worker.rb
 lib/gitlab/redis/*.rb
 lib/gitlab/gitaly_client/operation_service.rb
+app/models/project_services/packagist_service.rb
+lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb
 lib/gitlab/background_migration/*
 app/models/project_services/kubernetes_service.rb
 lib/gitlab/workhorse.rb
@@ -19,6 +26,8 @@ ee/db/**/*
 ee/app/serializers/ee/merge_request_widget_entity.rb
 ee/lib/api/epics.rb
 ee/lib/api/geo_nodes.rb
+ee/lib/ee/api/group_boards.rb
+ee/lib/ee/api/boards.rb
 ee/lib/ee/gitlab/ldap/sync/admin_users.rb
 ee/app/workers/geo/file_download_dispatch_worker/job_artifact_job_finder.rb
 ee/app/workers/geo/file_download_dispatch_worker/lfs_object_job_finder.rb

app/services/labels/find_or_create_service.rb

@@ -20,6 +20,7 @@ module Labels
       @available_labels ||= LabelsFinder.new(
         current_user,
         "#{parent_type}_id".to_sym => parent.id,
+        include_ancestor_groups: include_ancestor_groups?,
         only_group_labels: parent_is_group?
       ).execute(skip_authorization: skip_authorization)
     end
@@ -30,7 +31,8 @@ module Labels
       new_label = available_labels.find_by(title: title)
 
       if new_label.nil? && (skip_authorization || Ability.allowed?(current_user, :admin_label, parent))
-        new_label = Labels::CreateService.new(params).execute(parent_type.to_sym => parent)
+        create_params = params.except(:include_ancestor_groups)
+        new_label = Labels::CreateService.new(create_params).execute(parent_type.to_sym => parent)
       end
 
       new_label
@@ -47,5 +49,9 @@ module Labels
     def parent_is_group?
       parent_type == "group"
     end
+
+    def include_ancestor_groups?
+      params[:include_ancestor_groups] == true
+    end
   end
 end

lib/api/boards.rb

@@ -33,6 +33,7 @@ module API
           success Entities::Board
         end
         get '/:board_id' do
+          authorize!(:read_board, user_project)
           present board, with: Entities::Board
         end
       end

spec/services/labels/find_or_create_service_spec.rb

@@ -44,6 +44,26 @@ describe Labels::FindOrCreateService do
             expect(service.execute).to eq project_label
           end
         end
+
+        context 'when include_ancestor_groups is true' do
+          let(:group)   { create(:group, :nested) }
+          let(:params) do
+            {
+              title: 'Audit',
+              include_ancestor_groups: true
+            }
+          end
+
+          it 'returns the ancestor group labels' do
+            group_label = create(:group_label, group: group.parent, title: 'Audit')
+
+            expect(service.execute).to eq group_label
+          end
+
+          it 'creates new labels if labels are not found' do
+            expect { service.execute }.to change(project.labels, :count).by(1)
+          end
+        end
       end
 
       context 'when finding labels on group level' do