Put ArtifactsController#index behind feature flag

app/controllers/projects/artifacts_controller.rb

@@ -16,6 +16,12 @@ class Projects::ArtifactsController < Projects::ApplicationController
   MAX_PER_PAGE = 20
 
   def index
+    # Loading artifacts is very expensive in projects with a lot of artifacts.
+    # This feature flag prevents a DOS attack vector.
+    # It should be removed only after resolving the underlying performance
+    # issues: https://gitlab.com/gitlab-org/gitlab/issues/32281
+    return head :no_content unless Feature.enabled?(:artifacts_management_page, @project)
+
     finder = ArtifactsFinder.new(@project, artifacts_params)
     all_artifacts = finder.execute
 

spec/controllers/projects/artifacts_controller_spec.rb

@@ -23,27 +23,57 @@ describe Projects::ArtifactsController do
   describe 'GET index' do
     subject { get :index, params: { namespace_id: project.namespace, project_id: project } }
 
-    it 'sets the artifacts variable' do
-      subject
+    context 'when feature flag is on' do
+      before do
+        stub_feature_flags(artifacts_management_page: true)
+      end
 
-      expect(assigns(:artifacts)).to contain_exactly(*project.job_artifacts)
-    end
+      it 'sets the artifacts variable' do
+        subject
 
-    it 'sets the total size variable' do
-      subject
+        expect(assigns(:artifacts)).to contain_exactly(*project.job_artifacts)
+      end
+
+      it 'sets the total size variable' do
+        subject
+
+        expect(assigns(:total_size)).to eq(project.job_artifacts.total_size)
+      end
+
+      describe 'pagination' do
+        before do
+          stub_const("#{described_class}::MAX_PER_PAGE", 1)
+        end
+
+        it 'paginates artifacts' do
+          subject
 
-      expect(assigns(:total_size)).to eq(project.job_artifacts.total_size)
+          expect(assigns(:artifacts)).to contain_exactly(project.job_artifacts.last)
+        end
+      end
     end
 
-    describe 'pagination' do
+    context 'when feature flag is off' do
       before do
-        stub_const("#{described_class}::MAX_PER_PAGE", 1)
+        stub_feature_flags(artifacts_management_page: false)
+      end
+
+      it 'renders no content' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:no_content)
+      end
+
+      it 'does not set the artifacts variable' do
+        subject
+
+        expect(assigns(:artifacts)).to eq(nil)
       end
 
-      it 'paginates artifacts' do
+      it 'does not set the total size variable' do
         subject
 
-        expect(assigns(:artifacts)).to contain_exactly(project.job_artifacts.last)
+        expect(assigns(:total_size)).to eq(nil)
       end
     end
   end