Merge branch '207334-reposition_note_permissions' into 'master'

Add reposition_note permission

See merge request gitlab-org/gitlab!45957

app/assets/javascripts/issue_show/components/header_actions.vue

@@ -81,7 +81,7 @@ export default {
         })
         .then(({ data }) => {
           if (data.updateIssue.errors.length) {
-            createFlash(data.updateIssue.errors.join('. '));
+            createFlash({ message: data.updateIssue.errors.join('. ') });
             return;
           }
 
@@ -95,7 +95,7 @@ export default {
           // Dispatch event which updates open/close state, shared among the issue show page
           document.dispatchEvent(new CustomEvent('issuable_vue_app:change', payload));
         })
-        .catch(() => createFlash(__('Update failed. Please try again.')))
+        .catch(() => createFlash({ message: __('Update failed. Please try again.') }))
         .finally(() => {
           this.isUpdatingState = false;
         });

app/assets/javascripts/pages/projects/ci/lints/new/index.js

@@ -7,11 +7,11 @@ document.addEventListener('DOMContentLoaded', () => {
   if (gon?.features?.ciLintVue) {
     import(/* webpackChunkName: 'ciLintIndex' */ '~/ci_lint/index')
       .then(module => module.default())
-      .catch(() => createFlash(ERROR));
+      .catch(() => createFlash({ message: ERROR }));
   } else {
     import(/* webpackChunkName: 'ciLintEditor' */ '../ci_lint_editor')
       // eslint-disable-next-line new-cap
       .then(module => new module.default())
-      .catch(() => createFlash(ERROR));
+      .catch(() => createFlash({ message: ERROR }));
   }
 });

app/assets/javascripts/pages/projects/ci/lints/show/index.js

@@ -7,11 +7,11 @@ document.addEventListener('DOMContentLoaded', () => {
   if (gon?.features?.ciLintVue) {
     import(/* webpackChunkName: 'ciLintIndex' */ '~/ci_lint/index')
       .then(module => module.default())
-      .catch(() => createFlash(ERROR));
+      .catch(() => createFlash({ message: ERROR }));
   } else {
     import(/* webpackChunkName: 'ciLintEditor' */ '../ci_lint_editor')
       // eslint-disable-next-line new-cap
       .then(module => new module.default())
-      .catch(() => createFlash(ERROR));
+      .catch(() => createFlash({ message: ERROR }));
   }
 });

app/assets/javascripts/pages/projects/commit/show/index.js

@@ -40,7 +40,7 @@ document.addEventListener('DOMContentLoaded', () => {
         new Diff();
       })
       .catch(() => {
-        flash(__('An error occurred while retrieving diff files'));
+        flash({ message: __('An error occurred while retrieving diff files') });
       });
   } else {
     new Diff();

app/assets/javascripts/vue_shared/components/filtered_search_bar/tokens/milestone_token.vue

@@ -65,7 +65,7 @@ export default {
         .then(({ data }) => {
           this.milestones = data;
         })
-        .catch(() => createFlash(__('There was a problem fetching milestones.')))
+        .catch(() => createFlash({ message: __('There was a problem fetching milestones.') }))
         .finally(() => {
           this.loading = false;
         });

app/graphql/types/group_invitation_type.rb

+# frozen_string_literal: true
+
+module Types
+  class GroupInvitationType < BaseObject
+    expose_permissions Types::PermissionTypes::Group
+    authorize :read_group
+
+    implements InvitationInterface
+
+    graphql_name 'GroupInvitation'
+    description 'Represents a Group Invitation'
+
+    field :group, Types::GroupType, null: true,
+          description: 'Group that a User is invited to',
+          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, obj.source_id).find }
+  end
+end

app/graphql/types/invitation_interface.rb

+# frozen_string_literal: true
+
+module Types
+  module InvitationInterface
+    include BaseInterface
+
+    field :email, GraphQL::STRING_TYPE, null: false,
+          description: 'Email of the member to invite'
+
+    field :access_level, Types::AccessLevelType, null: true,
+          description: 'GitLab::Access level'
+
+    field :created_by, Types::UserType, null: true,
+          description: 'User that authorized membership'
+
+    field :created_at, Types::TimeType, null: true,
+          description: 'Date and time the membership was created'
+
+    field :updated_at, Types::TimeType, null: true,
+          description: 'Date and time the membership was last updated'
+
+    field :expires_at, Types::TimeType, null: true,
+          description: 'Date and time the membership expires'
+
+    field :user, Types::UserType, null: true,
+          description: 'User that is associated with the member object'
+
+    definition_methods do
+      def resolve_type(object, context)
+        case object
+        when GroupMember
+          Types::GroupInvitationType
+        when ProjectMember
+          Types::ProjectInvitationType
+        else
+          raise ::Gitlab::Graphql::Errors::BaseError, "Unknown member type #{object.class.name}"
+        end
+      end
+    end
+  end
+end

app/graphql/types/project_invitation_type.rb

+# frozen_string_literal: true
+
+module Types
+  class ProjectInvitationType < BaseObject
+    graphql_name 'ProjectInvitation'
+    description 'Represents a Project Membership Invitation'
+
+    expose_permissions Types::PermissionTypes::Project
+
+    implements InvitationInterface
+
+    authorize :read_project
+
+    field :project, Types::ProjectType, null: true,
+          description: 'Project ID for the project of the invitation'
+
+    def project
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.source_id).find
+    end
+  end
+end

app/helpers/issues_helper.rb

@@ -160,7 +160,7 @@ module IssuesHelper
       can_report_spam: issue.submittable_as_spam_by?(current_user).to_s,
       can_update_issue: can?(current_user, :update_issue, issue).to_s,
       iid: issue.iid,
-      is_issue_author: issue.author == current_user,
+      is_issue_author: (issue.author == current_user).to_s,
       new_issue_path: new_project_issue_path(project),
       project_path: project.full_path,
       report_abuse_path: new_abuse_report_path(user_id: issue.author.id, ref_url: issue_url(issue)),

app/models/concerns/from_union.rb

@@ -37,27 +37,6 @@ module FromUnion
     # rubocop: disable Gitlab/Union
     extend FromSetOperator
     define_set_operator Gitlab::SQL::Union
-
-    alias_method :from_union_set_operator, :from_union
-    def from_union(members, remove_duplicates: true, alias_as: table_name)
-      if Feature.enabled?(:sql_set_operators)
-        from_union_set_operator(members, remove_duplicates: remove_duplicates, alias_as: alias_as)
-      else
-        # The original from_union method.
-        standard_from_union(members, remove_duplicates: remove_duplicates, alias_as: alias_as)
-      end
-    end
-
-    private
-
-    def standard_from_union(members, remove_duplicates: true, alias_as: table_name)
-      union = Gitlab::SQL::Union
-        .new(members, remove_duplicates: remove_duplicates)
-        .to_sql
-
-      from(Arel.sql("(#{union}) #{alias_as}"))
-    end
-
     # rubocop: enable Gitlab/Union
   end
 end

app/models/deployment.rb

@@ -79,8 +79,6 @@ class Deployment < ApplicationRecord
 
     after_transition any => :running do |deployment|
       deployment.run_after_commit do
-        next unless Feature.enabled?(:ci_send_deployment_hook_when_start, deployment.project)
-
         Deployments::ExecuteHooksWorker.perform_async(id)
       end
     end

app/models/member.rb

@@ -96,6 +96,8 @@ class Member < ApplicationRecord
   scope :owners, -> { active.where(access_level: OWNER) }
   scope :owners_and_maintainers, -> { active.where(access_level: [OWNER, MAINTAINER]) }
   scope :with_user, -> (user) { where(user: user) }
+  scope :with_user_by_email, -> (email) { left_join_users.where(users: { email: email } ) }
+
   scope :preload_user_and_notification_settings, -> { preload(user: :notification_settings) }
 
   scope :with_source_id, ->(source_id) { where(source_id: source_id) }

app/presenters/invitation_presenter.rb

+# frozen_string_literal: true
+
+class InvitationPresenter < Gitlab::View::Presenter::Delegated
+  presents :invitation
+end

app/services/members/invite_service.rb

+# frozen_string_literal: true
+
+module Members
+  class InviteService < Members::BaseService
+    DEFAULT_LIMIT = 100
+
+    attr_reader :errors
+
+    def initialize(current_user, params)
+      @current_user, @params = current_user, params.dup
+      @errors = {}
+    end
+
+    def execute(source)
+      return error(s_('Email cannot be blank')) if params[:email].blank?
+
+      emails = params[:email].split(',').uniq.flatten
+      return error(s_("Too many users specified (limit is %{user_limit})") % { user_limit: user_limit }) if
+        user_limit && emails.size > user_limit
+
+      emails.each do |email|
+        next if existing_member?(source, email)
+
+        next if existing_invite?(source, email)
+
+        if existing_user?(email)
+          add_existing_user_as_member(current_user, source, params, email)
+          next
+        end
+
+        invite_new_member_and_user(current_user, source, params, email)
+      end
+
+      return success unless errors.any?
+
+      error(errors)
+    end
+
+    private
+
+    def invite_new_member_and_user(current_user, source, params, email)
+      new_member = (source.class.name + 'Member').constantize.create(source_id: source.id,
+        user_id: nil,
+        access_level: params[:access_level],
+        invite_email: email,
+        created_by_id: current_user.id,
+        expires_at: params[:expires_at],
+        requested_at: Time.current.utc)
+
+      unless new_member.valid? && new_member.persisted?
+        errors[params[:email]] = new_member.errors.full_messages.to_sentence
+      end
+    end
+
+    def add_existing_user_as_member(current_user, source, params, email)
+      new_member = create_member(current_user, existing_user(email), source, params.merge({ invite_email: email }))
+
+      unless new_member.valid? && new_member.persisted?
+        errors[email] = new_member.errors.full_messages.to_sentence
+      end
+    end
+
+    def create_member(current_user, user, source, params)
+      source.add_user(user, params[:access_level], current_user: current_user, expires_at: params[:expires_at])
+    end
+
+    def user_limit
+      limit = params.fetch(:limit, DEFAULT_LIMIT)
+
+      limit && limit < 0 ? nil : limit
+    end
+
+    def existing_member?(source, email)
+      existing_member = source.members.with_user_by_email(email).exists?
+
+      if existing_member
+        errors[email] = "Already a member of #{source.name}"
+        return true
+      end
+
+      false
+    end
+
+    def existing_invite?(source, email)
+      existing_invite = source.members.search_invite_email(email).exists?
+
+      if existing_invite
+        errors[email] = "Member already invited to #{source.name}"
+        return true
+      end
+
+      false
+    end
+
+    def existing_user(email)
+      User.find_by_email(email)
+    end
+
+    def existing_user?(email)
+      existing_user(email).present?
+    end
+  end
+end

app/workers/concerns/application_worker.rb

@@ -19,7 +19,7 @@ module ApplicationWorker
 
     def structured_payload(payload = {})
       context = Labkit::Context.current.to_h.merge(
-        'class' => self.class,
+        'class' => self.class.name,
         'job_status' => 'running',
         'queue' => self.class.queue,
         'jid' => jid

changelogs/unreleased/263552-number-of-projects-active-alerts.yml

+---
+title: Add metric count for projects with alerts created
+merge_request: 46636
+author:
+type: added

changelogs/unreleased/273356-remove-sql_set_operators-feature-flag.yml

+---
+title: Enable refactored union set operator
+merge_request: 46295
+author:
+type: added

changelogs/unreleased/add-post-invitations-with-email.yml

+---
+title: Add API post /invitations by email
+merge_request: 45950
+author:
+type: added

changelogs/unreleased/fj-forbid-top-level-route-sitemap.yml

+---
+title: Forbid top level route sitemap
+merge_request: 46677
+author:
+type: changed

config/feature_flags/development/ci_send_deployment_hook_when_start.yml

----
-name: ci_send_deployment_hook_when_start
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/41214
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/247137
-group: group::progressive delivery
-type: development
-default_enabled: false

config/feature_flags/development/sql_set_operators.yml

----
-name: sql_set_operators
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/39786
-rollout_issue_url:
-group: group::access
-type: development
-default_enabled: false

config/initializers/grape_validators.rb

@@ -8,3 +8,4 @@ Grape::Validations.register_validator(:integer_none_any, ::API::Validations::Val
 Grape::Validations.register_validator(:array_none_any, ::API::Validations::Validators::ArrayNoneAny)
 Grape::Validations.register_validator(:check_assignees_count, ::API::Validations::Validators::CheckAssigneesCount)
 Grape::Validations.register_validator(:untrusted_regexp, ::API::Validations::Validators::UntrustedRegexp)
+Grape::Validations.register_validator(:email_or_email_list, ::API::Validations::Validators::EmailOrEmailList)

db/migrate/20201029144444_create_vulnerability_finding_links.rb

+# frozen_string_literal: true
+
+class CreateVulnerabilityFindingLinks < ActiveRecord::Migration[6.0]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    create_table :vulnerability_finding_links, if_not_exists: true do |t|
+      t.timestamps_with_timezone null: false
+      t.references :vulnerability_occurrence, index: { name: 'finding_links_on_vulnerability_occurrence_id' }, null: false, foreign_key: { on_delete: :cascade }
+      t.text :name, limit: 255
+      t.text :url, limit: 2048, null: false
+    end
+
+    add_text_limit :vulnerability_finding_links, :name, 255
+    add_text_limit :vulnerability_finding_links, :url, 2048
+  end
+
+  def down
+    drop_table :vulnerability_finding_links
+  end
+end

db/post_migrate/20201102112206_rename_sitemap_namespace.rb

+# frozen_string_literal: true
+
+class RenameSitemapNamespace < ActiveRecord::Migration[6.0]
+  include Gitlab::Database::MigrationHelpers
+  include Gitlab::Database::RenameReservedPathsMigration::V1
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  # We're taking over the /sitemap namespace
+  # since it's necessary for the default behavior of Sitemaps
+  def up
+    disable_statement_timeout do
+      rename_root_paths(['sitemap'])
+    end
+  end
+
+  def down
+    disable_statement_timeout do
+      revert_renames
+    end
+  end
+end

db/schema_migrations/20201029144444

+50e4e42c804d3abdcfe9ab2bbb890262d4b2ddd93bff1b2af1da1e55a0300cf5
\ No newline at end of file

db/schema_migrations/20201102112206

+a861c91ebc7f7892020ba10a151df761b38bf69d5e02bcdf72a965eb266e6aff
\ No newline at end of file

db/structure.sql

@@ -17104,6 +17104,26 @@ CREATE SEQUENCE vulnerability_feedback_id_seq
 
 ALTER SEQUENCE vulnerability_feedback_id_seq OWNED BY vulnerability_feedback.id;
 
+CREATE TABLE vulnerability_finding_links (
+    id bigint NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    vulnerability_occurrence_id bigint NOT NULL,
+    name text,
+    url text NOT NULL,
+    CONSTRAINT check_55f0a95439 CHECK ((char_length(name) <= 255)),
+    CONSTRAINT check_b7fe886df6 CHECK ((char_length(url) <= 2048))
+);
+
+CREATE SEQUENCE vulnerability_finding_links_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE vulnerability_finding_links_id_seq OWNED BY vulnerability_finding_links.id;
+
 CREATE TABLE vulnerability_historical_statistics (
     id bigint NOT NULL,
     created_at timestamp with time zone NOT NULL,
@@ -18203,6 +18223,8 @@ ALTER TABLE ONLY vulnerability_exports ALTER COLUMN id SET DEFAULT nextval('vuln
 
 ALTER TABLE ONLY vulnerability_feedback ALTER COLUMN id SET DEFAULT nextval('vulnerability_feedback_id_seq'::regclass);
 
+ALTER TABLE ONLY vulnerability_finding_links ALTER COLUMN id SET DEFAULT nextval('vulnerability_finding_links_id_seq'::regclass);
+
 ALTER TABLE ONLY vulnerability_historical_statistics ALTER COLUMN id SET DEFAULT nextval('vulnerability_historical_statistics_id_seq'::regclass);
 
 ALTER TABLE ONLY vulnerability_identifiers ALTER COLUMN id SET DEFAULT nextval('vulnerability_identifiers_id_seq'::regclass);
@@ -19646,6 +19668,9 @@ ALTER TABLE ONLY vulnerability_exports
 ALTER TABLE ONLY vulnerability_feedback
     ADD CONSTRAINT vulnerability_feedback_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY vulnerability_finding_links
+    ADD CONSTRAINT vulnerability_finding_links_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY vulnerability_historical_statistics
     ADD CONSTRAINT vulnerability_historical_statistics_pkey PRIMARY KEY (id);
 
@@ -19870,6 +19895,8 @@ CREATE UNIQUE INDEX epic_user_mentions_on_epic_id_and_note_id_index ON epic_user
 
 CREATE UNIQUE INDEX epic_user_mentions_on_epic_id_index ON epic_user_mentions USING btree (epic_id) WHERE (note_id IS NULL);
 
+CREATE INDEX finding_links_on_vulnerability_occurrence_id ON vulnerability_finding_links USING btree (vulnerability_occurrence_id);
+
 CREATE INDEX idx_audit_events_on_entity_id_desc_author_id_created_at ON audit_events USING btree (entity_id, entity_type, id DESC, author_id, created_at);
 
 CREATE INDEX idx_ci_pipelines_artifacts_locked ON ci_pipelines USING btree (ci_ref_id, id) WHERE (locked = 1);
@@ -24195,6 +24222,9 @@ ALTER TABLE ONLY gpg_signatures
 ALTER TABLE ONLY board_group_recent_visits
     ADD CONSTRAINT fk_rails_ca04c38720 FOREIGN KEY (board_id) REFERENCES boards(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY vulnerability_finding_links
+    ADD CONSTRAINT fk_rails_cbdfde27ce FOREIGN KEY (vulnerability_occurrence_id) REFERENCES vulnerability_occurrences(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY issues_self_managed_prometheus_alert_events
     ADD CONSTRAINT fk_rails_cc5d88bbb0 FOREIGN KEY (issue_id) REFERENCES issues(id) ON DELETE CASCADE;
 

doc/api/api_resources.md

@@ -40,6 +40,7 @@ The following API resources are available in the project context:
 | [Events](events.md)                                                 | `/projects/:id/events` (also available for users and standalone)                                                                                                                                      |
 | [Feature Flags](feature_flags.md)                                   | `/projects/:id/feature_flags`                                                                                                                                                                         |
 | [Feature Flag User Lists](feature_flag_user_lists.md)               | `/projects/:id/feature_flags_user_lists`                                                                                                                                                              |
+| [Invitations](invitations.md)                                       | `/projects/:id/invitations` (also available for groups)                                                                                                                                              |
 | [Issues](issues.md)                                                 | `/projects/:id/issues` (also available for groups and standalone)                                                                                                                                     |
 | [Issues Statistics](issues_statistics.md)                           | `/projects/:id/issues_statistics` (also available for groups and standalone)                                                                                                                          |
 | [Issue boards](boards.md)                                           | `/projects/:id/boards`                                                                                                                                                                                |
@@ -108,6 +109,7 @@ The following API resources are available in the group context:
 | [Group labels](group_labels.md)                                  | `/groups/:id/labels`                                                             |
 | [Group-level variables](group_level_variables.md)                | `/groups/:id/variables`                                                          |
 | [Group milestones](group_milestones.md)                          | `/groups/:id/milestones`                                                         |
+| [Invitations](invitations.md)                                    | `/groups/:id/invitations` (also available for projects)                          |
 | [Issues](issues.md)                                              | `/groups/:id/issues` (also available for projects and standalone)                |
 | [Issues Statistics](issues_statistics.md)                        | `/groups/:id/issues_statistics` (also available for projects and standalone)     |
 | [Members](members.md)                                            | `/groups/:id/members` (also available for projects)                              |

doc/api/invitations.md

+---
+stage: Growth
+group: Expansion
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#designated-technical-writers
+---
+
+# Invitations API
+
+Use the Invitations API to send email to users you want to join a group or project.
+
+## Valid access levels
+
+To send an invitation, you must have access to the project or group you are sending email for. Valid access
+levels are defined in the `Gitlab::Access` module. Currently, these levels are valid:
+
+- No access (`0`)
+- Guest (`10`)
+- Reporter (`20`)
+- Developer (`30`)
+- Maintainer (`40`)
+- Owner (`50`) - Only valid to set for groups
+
+CAUTION: **Caution:**
+Due to [an issue](https://gitlab.com/gitlab-org/gitlab/-/issues/219299),
+projects in personal namespaces will not show owner (`50`) permission.
+
+## Invite by email to group or project
+
+Invites a new user by email to join a group or project.
+
+```plaintext
+POST /groups/:id/invitations
+POST /projects/:id/invitations
+```
+
+| Attribute | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `id`      | integer/string | yes | The ID or [URL-encoded path of the project or group](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `email` | integer/string | yes | The email of the new member or multiple emails separated by commas |
+| `access_level` | integer | yes | A valid access level |
+| `expires_at` | string | no | A date string in the format YEAR-MONTH-DAY |
+
+```shell
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --data "email=test@example.com&access_level=30" "https://gitlab.example.com/api/v4/groups/:id/invitations"
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --data "email=test@example.com&access_level=30" "https://gitlab.example.com/api/v4/projects/:id/invitations"
+```
+
+Example responses:
+
+When all emails were successfully sent:
+
+```json
+{  "status":  "success"  }
+```
+
+When there was any error sending the email:
+
+```json
+{
+  "status": "error",
+  "message": {
+               "test@example.com": "Already invited",
+               "test2@example.com": "Member already exsists"
+             }
+}
+```

doc/api/project_repository_storage_moves.md

@@ -216,7 +216,7 @@ Parameters:
 Example request:
 
 ```shell
-curl --request POST --header "PRIVATE_TOKEN: <your_access_token>" --header "Content-Type: application/json" \
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --header "Content-Type: application/json" \
 --data '{"destination_storage_name":"storage2"}' "https://gitlab.example.com/api/v4/projects/1/repository_storage_moves"
 ```
 

doc/development/api_styleguide.md

@@ -207,6 +207,12 @@ guide on how you can add a new custom validator.
   checks if the value of the given parameter is either an `Array`, `None`, or `Any`.
   It allows only either of these mentioned values to move forward in the request.
 
+- `EmailOrEmailList`:
+
+  The [`EmailOrEmailList` validator](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/api/validations/validators/email_or_email_list.rb)
+  checks if the value of a string or a list of strings contains only valid
+  email addresses. It allows only lists with all valid email addresses to move forward in the request.
+
 ### Adding a new custom validator
 
 Custom validators are a great way to validate parameters before sending

doc/development/architecture.md

@@ -258,6 +258,7 @@ Table description links:
 | [NGINX](#nginx)                                       | Routes requests to appropriate components, terminates SSL            |       ✅        |      ✅       |        ⚙         |     ✅      |   ⤓    |  ❌  | CE & EE |
 | [Node Exporter](#node-exporter)                       | Prometheus endpoint with system metrics                              |       ✅        |     N/A      |       N/A        |     ✅      |   ❌    |  ❌  | CE & EE |
 | [Outbound email (SMTP)](#outbound-email)              | Send email messages to users                                         |       ⤓        |      ⚙       |        ⤓         |     ✅      |   ⤓    |  ⤓  | CE & EE |
+| [Patroni](#patroni)                                   | Manage PostgreSQL HA cluster leader selection and replication        |       ⚙        |      ❌       |        ❌         |     ✅      |   ❌    |  ❌  | EE Only |
 | [PgBouncer Exporter](#pgbouncer-exporter)             | Prometheus endpoint with PgBouncer metrics                           |       ⚙        |      ❌       |        ❌         |     ✅      |   ❌    |  ❌  | CE & EE |
 | [PgBouncer](#pgbouncer)                               | Database connection pooling, failover                                |       ⚙        |      ❌       |        ❌         |     ✅      |   ❌    |  ❌  | EE Only |
 | [PostgreSQL Exporter](#postgresql-exporter)           | Prometheus endpoint with PostgreSQL metrics                          |       ✅        |      ✅       |        ✅         |     ✅      |   ❌    |  ❌  | CE & EE |
@@ -545,6 +546,15 @@ NGINX has an Ingress port for all HTTP requests and routes them to the appropria
 
 [Node Exporter](https://github.com/prometheus/node_exporter) is a Prometheus tool that gives us metrics on the underlying machine (think CPU/Disk/Load). It's just a packaged version of the common open source offering from the Prometheus project.
 
+#### Patroni
+
+- [Project Page](https://github.com/zalando/patroni)
+- Configuration:
+  - [Omnibus](../administration/postgresql/replication_and_failover.md#patroni)
+- Layer: Core Service (Data)
+- Process: `patroni`
+- GitLab.com: [Database Architecture](https://about.gitlab.com/handbook/engineering/infrastructure/production/architecture/#database-architecture)
+
 #### PgBouncer
 
 - [Project page](https://github.com/pgbouncer/pgbouncer/blob/master/README.md)

doc/development/contributing/style_guides.md

@@ -17,9 +17,8 @@ we suggest investigating to see if a plugin exists. For instance here is the
 
 ## Pre-push static analysis
 
-We strongly recommend installing
-[Lefthook](https://github.com/Arkweid/lefthook) to automatically check for
-static analysis offenses before pushing your changes.
+We strongly recommend installing [Lefthook](https://github.com/Arkweid/lefthook) to automatically check
+for static analysis offenses before pushing your changes.
 
 To install `lefthook`, run the following in your GitLab source directory:
 
@@ -33,10 +32,9 @@ overcommit --uninstall
 gem install lefthook && lefthook install -f
 ```
 
-Before you push your changes, Lefthook will then automatically run Danger checks, as well
-as RuboCop, ES Lint, HAML Lint, and SCSS Lint for the changed files.
-
-This saves you time as you don't have to wait for the same errors to be detected by CI/CD.
+Before you push your changes, Lefthook then automatically run Danger checks, and other checks
+for changed files. This saves you time as you don't have to wait for the same errors to be detected
+by CI/CD.
 
 Lefthook relies on a pre-push hook to prevent commits that violate its ruleset.
 If you wish to override this behavior, pass the environment variable `LEFTHOOK=0`.
@@ -45,7 +43,8 @@ That is, `LEFTHOOK=0 git push`.
 You can also:
 
 - Define [local configuration](https://github.com/Arkweid/lefthook/blob/master/docs/full_guide.md#local-config).
-- Skip [checks per tag on the fly](https://github.com/Arkweid/lefthook/blob/master/docs/full_guide.md#skip-some-tags-on-the-fly).
+- Skip [checks per tag on the fly](https://github.com/Arkweid/lefthook/blob/master/docs/full_guide.md#skip-some-tags-on-the-fly), e.g. `LEFTHOOK_EXCLUDE=frontend git push origin`.
+- Run [hooks manually](https://github.com/Arkweid/lefthook/blob/master/docs/full_guide.md#run-githook-group-directly), e.g. `lefthook run pre-push`.
 
 ## Ruby, Rails, RSpec
 

doc/development/documentation/index.md

@@ -708,15 +708,14 @@ Git [pre-commit hooks](https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks)
 run tests or other processes before committing to a branch, with the ability to not commit to the branch if
 failures occur with these tests.
 
-[`overcommit`](https://github.com/sds/overcommit) is a Git hooks manager, making configuring,
+[`lefthook`](https://github.com/Arkweid/lefthook) is a Git hooks manager, making configuring,
 installing, and removing Git hooks easy.
 
-Sample configuration for `overcommit` is available in the
-[`.overcommit.yml.example`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.overcommit.yml.example)
+Configuration for `left` is available in the [`lefthook.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lefthook.yml)
 file for the [`gitlab`](https://gitlab.com/gitlab-org/gitlab) project.
 
-To set up `overcommit` for documentation linting, see
-[Pre-commit static analysis](../contributing/style_guides.md#pre-push-static-analysis).
+To set up `lefthook` for documentation linting, see
+[Pre-push static analysis](../contributing/style_guides.md#pre-push-static-analysis).
 
 #### Disable Vale tests
 

doc/user/application_security/dast/index.md

@@ -161,6 +161,12 @@ headers whose values you want masked. For details on how to mask headers, see
 
 It's also possible to authenticate the user before performing the DAST checks.
 
+**Important:** It is highly recommended that you configure the scanner to authenticate to the application,
+or it will not be able to check most of the application for security risks, as most
+of your application is likely not accessible without authentication. It is also recommended
+that you periodically confirm the scanner's authentication is still working as this tends to break over
+time due to authentication changes to the application.
+
 Create masked variables to pass the credentials that DAST uses.
 To create masked variables for the username and password, see [Create a custom variable in the UI](../../../ci/variables/README.md#create-a-custom-variable-in-the-ui).
 Note that the key of the username variable must be `DAST_USERNAME`

doc/user/reserved_names.md

@@ -82,6 +82,7 @@ Currently the following names are reserved as top level groups:
 - `s`
 - `search`
 - `sent_notifications`
+- `sitemap`
 - `sitemap.xml`
 - `sitemap.xml.gz`
 - `slash-command-logo.png`

ee/app/finders/security/pipeline_vulnerabilities_finder.rb

@@ -75,7 +75,7 @@ module Security
     def normalize_report_findings(report_findings, vulnerabilities)
       report_findings.map do |report_finding|
         finding_hash = report_finding.to_hash
-          .except(:compare_key, :identifiers, :location, :scanner)
+          .except(:compare_key, :identifiers, :location, :scanner, :links)
 
         finding = Vulnerabilities::Finding.new(finding_hash)
         # assigning Vulnerabilities to Findings to enable the computed state
@@ -84,6 +84,9 @@ module Security
         finding.project = pipeline.project
         finding.sha = pipeline.sha
         finding.build_scanner(report_finding.scanner&.to_hash)
+        finding.finding_links = report_finding.links.map do |link|
+          Vulnerabilities::FindingLink.new(link.to_hash)
+        end
         finding.identifiers = report_finding.identifiers.map do |identifier|
           Vulnerabilities::Identifier.new(identifier.to_hash)
         end

ee/app/models/vulnerabilities/finding.rb

@@ -26,6 +26,8 @@ module Vulnerabilities
     has_many :finding_identifiers, class_name: 'Vulnerabilities::FindingIdentifier', inverse_of: :finding, foreign_key: 'occurrence_id'
     has_many :identifiers, through: :finding_identifiers, class_name: 'Vulnerabilities::Identifier'
 
+    has_many :finding_links, class_name: 'Vulnerabilities::FindingLink', inverse_of: :finding, foreign_key: 'vulnerability_occurrence_id'
+
     has_many :finding_pipelines, class_name: 'Vulnerabilities::FindingPipeline', inverse_of: :finding, foreign_key: 'occurrence_id'
     has_many :pipelines, through: :finding_pipelines, class_name: 'Ci::Pipeline'
 
@@ -256,7 +258,9 @@ module Vulnerabilities
     end
 
     def links
-      metadata.fetch('links', [])
+      return metadata.fetch('links', []) if finding_links.load.empty?
+
+      finding_links.as_json(only: [:name, :url])
     end
 
     def remediations

ee/app/models/vulnerabilities/finding_link.rb

+# frozen_string_literal: true
+
+module Vulnerabilities
+  class FindingLink < ApplicationRecord
+    self.table_name = 'vulnerability_finding_links'
+
+    belongs_to :finding, class_name: 'Vulnerabilities::Finding', inverse_of: :finding_identifiers, foreign_key: 'vulnerability_occurrence_id'
+
+    validates :finding, presence: true
+    validates :url, presence: true, length: { maximum: 255 }
+    validates :name, length: { maximum: 2048 }
+  end
+end

ee/app/services/issues/create_from_vulnerability_data_service.rb

@@ -3,7 +3,7 @@
 module Issues
   class CreateFromVulnerabilityDataService < ::BaseService
     def execute
-      return error("Can't create issue") unless can?(@current_user, :create_issue, @project)
+      return error("User is not permitted to create issue") unless can?(@current_user, :create_issue, @project)
 
       begin
         vulnerability = Gitlab::Vulnerabilities::Parser.fabricate(@params)

ee/app/services/issues/create_from_vulnerability_service.rb

@@ -2,7 +2,7 @@
 module Issues
   class CreateFromVulnerabilityService < ::BaseContainerService
     def execute
-      return error("Can't create issue") unless can?(@current_user, :create_issue, @container)
+      return error("User is not permitted to create issue") unless can?(@current_user, :create_issue, @container)
 
       vulnerability = params[:vulnerability].present
       link_type = params[:link_type]

ee/app/services/merge_requests/create_from_vulnerability_data_service.rb

@@ -16,8 +16,8 @@ module MergeRequests
       ]
       target_branch = vulnerability.target_branch || @project.default_branch
 
-      return error("Can't create merge_request") unless can_create_merge_request?(source_branch)
-      return error("Can't create merge request") if vulnerability.remediations.empty?
+      return error("User is not permitted to create merge request") unless can_create_merge_request?(source_branch)
+      return error("No remediations available for merge request") if vulnerability.remediations.empty?
 
       patch_result = create_patch(vulnerability, source_branch, target_branch)
 

ee/app/services/security/store_report_service.rb

@@ -47,7 +47,8 @@ module Security
         return
       end
 
-      vulnerability_params = finding.to_hash.except(:compare_key, :identifiers, :location, :scanner, :scan)
+      vulnerability_params = finding.to_hash.except(:compare_key, :identifiers, :location, :scanner, :scan, :links)
+      vulnerability_params[:uuid] = calculate_uuid_v5(finding)
       vulnerability_finding = create_or_find_vulnerability_finding(finding, vulnerability_params)
 
       update_vulnerability_scanner(finding)
@@ -60,6 +61,8 @@ module Security
         create_or_update_vulnerability_identifier_object(vulnerability_finding, identifier)
       end
 
+      create_or_update_vulnerability_links(finding, vulnerability_finding)
+
       create_vulnerability_pipeline_object(vulnerability_finding, pipeline)
 
       create_vulnerability(vulnerability_finding, pipeline)
@@ -79,8 +82,6 @@ module Security
           .create_with(create_params)
           .find_or_initialize_by(find_params)
 
-        vulnerability_finding.uuid = calculcate_uuid_v5(vulnerability_finding, find_params)
-
         vulnerability_finding.save!
         vulnerability_finding
       rescue ActiveRecord::RecordNotUnique
@@ -90,11 +91,11 @@ module Security
       end
     end
 
-    def calculcate_uuid_v5(vulnerability_finding, finding_params)
+    def calculate_uuid_v5(vulnerability_finding)
       uuid_v5_name_components = {
         report_type: vulnerability_finding.report_type,
-        primary_identifier_fingerprint: vulnerability_finding.primary_identifier&.fingerprint || finding_params.dig(:primary_identifier, :fingerprint),
-        location_fingerprint: vulnerability_finding.location_fingerprint,
+        primary_identifier_fingerprint: vulnerability_finding.primary_fingerprint,
+        location_fingerprint: vulnerability_finding.location.fingerprint,
         project_id: project.id
       }
 
@@ -104,8 +105,6 @@ module Security
 
       name = uuid_v5_name_components.values.join('-')
 
-      Gitlab::AppLogger.debug(message: "Generating UUIDv5 with name: #{name}") if Gitlab.dev_env_or_com?
-
       Gitlab::Vulnerabilities::CalculateFindingUUID.call(name)
     end
 
@@ -125,6 +124,15 @@ module Security
     rescue ActiveRecord::RecordNotUnique
     end
 
+    def create_or_update_vulnerability_links(finding, vulnerability_finding)
+      return if finding.links.blank?
+
+      finding.links.each do |link|
+        vulnerability_finding.finding_links.safe_find_or_create_by!(link.to_hash)
+      end
+    rescue ActiveRecord::RecordNotUnique
+    end
+
     def create_vulnerability_pipeline_object(vulnerability_finding, pipeline)
       vulnerability_finding.finding_pipelines.find_or_create_by!(pipeline: pipeline)
     rescue ActiveRecord::RecordNotUnique

ee/app/views/shared/billings/_billing_plan.html.haml

@@ -35,7 +35,7 @@
       .card-footer.p-3
         .float-right{ class: ("invisible" unless purchase_link.action == 'upgrade' || is_current_plan) }
           - if show_contact_sales_button?(purchase_link.action)
-            = link_to s_('BillingPlan|Contact sales'), "#{contact_sales_url}?test=inappcontactsales#{plan.code}", class: "btn btn-success btn-inverted", data: { **experiment_tracking_data_for_button_click('contact_sales') }
+            = link_to s_('BillingPlan|Contact sales'), "#{contact_sales_url}?test=inappcontactsales#{plan.code}", class: "btn btn-success-secondary gl-button", data: { **experiment_tracking_data_for_button_click('contact_sales') }
           - upgrade_button_class = "disabled" if is_current_plan && !namespace.trial_active?
           - cta_class = '-new' if use_new_purchase_flow?(namespace)
-          = link_to s_('BillingPlan|Upgrade'), plan_purchase_or_upgrade_url(namespace, plan, current_plan), class: "btn btn-success #{upgrade_button_class} billing-cta-purchase#{cta_class}", data: { **experiment_tracking_data_for_button_click('upgrade') }
+          = link_to s_('BillingPlan|Upgrade'), plan_purchase_or_upgrade_url(namespace, plan, current_plan), class: "btn btn-success gl-button #{upgrade_button_class} billing-cta-purchase#{cta_class}", data: { **experiment_tracking_data_for_button_click('upgrade') }

ee/app/views/shared/billings/_billing_plan_header.html.haml

@@ -24,10 +24,10 @@
     %p= s_("BillingPlans|This group uses the plan associated with its parent group.")
     - parent_billing_page_link = link_to parent_group.full_name, group_billings_path(parent_group)
     %p= s_("BillingPlans|To manage the plan for this group, visit the billing section of %{parent_billing_page_link}.").html_safe % { parent_billing_page_link: parent_billing_page_link }
-    = link_to s_("BillingPlans|Manage plan"), group_billings_path(parent_group), class: 'btn btn-success'
+    = link_to s_("BillingPlans|Manage plan"), group_billings_path(parent_group), class: 'btn btn-success gl-button'
   - else
     = render 'shared/billings/trial_status', namespace: namespace
 
   - if namespace.eligible_for_trial?
     - glm_content = namespace_for_user ? 'user-billing' : 'group-billing'
-    %p= link_to 'Start your free trial', new_trial_registration_path(glm_source: 'gitlab.com', glm_content: glm_content), class: 'btn btn-primary'
+    %p= link_to 'Start your free trial', new_trial_registration_path(glm_source: 'gitlab.com', glm_content: glm_content), class: 'btn btn-primary gl-button'

ee/changelogs/unreleased/239174-add-vulnerability-link-model.yml

+---
+title: Add Vulnerabilities::FindingLink model
+merge_request: 46555
+author:
+type: added

ee/changelogs/unreleased/better_vuln_issue_mr_creation_errors.yml

+---
+title: Improve error messages for Vulnerability Issue/MR creation
+merge_request: 46589
+author:
+type: changed

ee/lib/gitlab/ci/parsers/security/common.rb

@@ -55,6 +55,7 @@ module Gitlab
 
           def create_vulnerability(report, data, version)
             identifiers = create_identifiers(report, data['identifiers'])
+            links = create_links(report, data['links'])
             report.add_finding(
               ::Gitlab::Ci::Reports::Security::Finding.new(
                 uuid: SecureRandom.uuid,
@@ -67,6 +68,7 @@ module Gitlab
                 scanner: create_scanner(report, data['scanner']),
                 scan: report&.scan,
                 identifiers: identifiers,
+                links: links,
                 raw_metadata: data.to_json,
                 metadata_version: version))
           end
@@ -106,6 +108,22 @@ module Gitlab
                 url: identifier['url']))
           end
 
+          def create_links(report, links)
+            return [] unless links.is_a?(Array)
+
+            links
+              .map { |link| create_link(report, link) }
+              .compact
+          end
+
+          def create_link(report, link)
+            return unless link.is_a?(Hash)
+
+            ::Gitlab::Ci::Reports::Security::Link.new(
+              name: link['name'],
+              url: link['url'])
+          end
+
           def parse_severity_level(input)
             return input if ::Vulnerabilities::Finding::SEVERITY_LEVELS.key?(input)
 

ee/lib/gitlab/ci/reports/security/finding.rb

@@ -10,6 +10,7 @@ module Gitlab
           attr_reader :compare_key
           attr_reader :confidence
           attr_reader :identifiers
+          attr_reader :links
           attr_reader :location
           attr_reader :metadata_version
           attr_reader :name
@@ -24,10 +25,11 @@ module Gitlab
 
           delegate :file_path, :start_line, :end_line, to: :location
 
-          def initialize(compare_key:, identifiers:, location:, metadata_version:, name:, raw_metadata:, report_type:, scanner:, scan:, uuid:, confidence: nil, severity: nil) # rubocop:disable Metrics/ParameterLists
+          def initialize(compare_key:, identifiers:, links: [], location:, metadata_version:, name:, raw_metadata:, report_type:, scanner:, scan:, uuid:, confidence: nil, severity: nil) # rubocop:disable Metrics/ParameterLists
             @compare_key = compare_key
             @confidence = confidence
             @identifiers = identifiers
+            @links = links
             @location = location
             @metadata_version = metadata_version
             @name = name
@@ -46,6 +48,7 @@ module Gitlab
               compare_key
               confidence
               identifiers
+              links
               location
               metadata_version
               name
@@ -94,8 +97,6 @@ module Gitlab
             end
           end
 
-          protected
-
           def primary_fingerprint
             primary_identifier&.fingerprint
           end

ee/lib/gitlab/ci/reports/security/link.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Reports
+      module Security
+        class Link
+          attr_accessor :name, :url
+
+          def initialize(name: nil, url: nil)
+            @name = name
+            @url = url
+          end
+
+          def to_hash
+            {
+              name: name,
+              url: url
+            }.compact
+          end
+        end
+      end
+    end
+  end
+end

ee/spec/factories/ci/reports/security/links.rb

+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :ci_reports_security_link, class: '::Gitlab::Ci::Reports::Security::Link' do
+    name { 'CVE-2020-0202' }
+    url { 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0202' }
+
+    skip_create
+
+    initialize_with do
+      ::Gitlab::Ci::Reports::Security::Link.new(**attributes)
+    end
+  end
+end

ee/spec/factories/vulnerabilities/finding_links.rb

+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :finding_link, class: 'Vulnerabilities::FindingLink' do
+    finding factory: :vulnerabilities_finding
+    name { 'CVE-2018-1234' }
+    url { 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1234' }
+  end
+end

ee/spec/fixtures/security_reports/master/gl-common-scanning-report.json

@@ -16,7 +16,7 @@
             "identifiers": [],
             "links": [
                 {
-                    "url": ""
+                    "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1020"
                 }
             ]
         },
@@ -37,7 +37,8 @@
             "identifiers": [],
             "links": [
                 {
-                    "url": ""
+                  "name": "CVE-1030",
+                  "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1030"
                 }
             ]
         },
@@ -56,12 +57,6 @@
             "location": {},
             "identifiers": [],
             "links": [
-                {
-                    "url": ""
-                },
-                {
-                    "url": ""
-                }
             ]
         }
     ],
@@ -122,4 +117,4 @@
         "end_time": "placeholder-value",
         "status": "success"
     }
-}
\ No newline at end of file
+}

ee/spec/graphql/mutations/dast_on_demand_scans/create_spec.rb

@@ -16,6 +16,8 @@ RSpec.describe Mutations::DastOnDemandScans::Create do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -33,52 +35,6 @@ RSpec.describe Mutations::DastOnDemandScans::Create do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'has no errors' do
-          group.add_owner(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'has no errors' do
-          project.add_maintainer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a developer' do
-        it 'has no errors' do
-          project.add_developer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a reporter' do
-        it 'raises an exception' do
-          project.add_reporter(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is a guest' do
-        it 'raises an exception' do
-          project.add_guest(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -152,14 +108,6 @@ RSpec.describe Mutations::DastOnDemandScans::Create do
             end
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_scanner_profiles/create_spec.rb

@@ -16,6 +16,8 @@ RSpec.describe Mutations::DastScannerProfiles::Create do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -35,12 +37,6 @@ RSpec.describe Mutations::DastScannerProfiles::Create do
       end
     end
 
-    context 'when the user is not associated with the project' do
-      it 'raises an exception' do
-        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-      end
-    end
-
     context 'when the user can run a dast scan' do
       before do
         group.add_owner(user)
@@ -83,14 +79,6 @@ RSpec.describe Mutations::DastScannerProfiles::Create do
           expect(response[:errors]).to include('Name has already been taken')
         end
       end
-
-      context 'when on demand scan licensed feature is not available' do
-        it 'raises an exception' do
-          stub_licensed_features(security_on_demand_scans: false)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
     end
   end
 end

ee/spec/graphql/mutations/dast_scanner_profiles/delete_spec.rb

@@ -15,6 +15,8 @@ RSpec.describe Mutations::DastScannerProfiles::Delete do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -54,14 +56,6 @@ RSpec.describe Mutations::DastScannerProfiles::Delete do
         end
       end
 
-      context 'when on demand scan licensed feature is not available' do
-        it 'raises an exception' do
-          stub_licensed_features(security_on_demand_scans: false)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
       context 'when deletion fails' do
         it 'returns an error' do
           allow_next_instance_of(::DastScannerProfiles::DestroyService) do |service|

ee/spec/graphql/mutations/dast_scanner_profiles/update_spec.rb

@@ -22,6 +22,8 @@ RSpec.describe Mutations::DastScannerProfiles::Update do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -47,20 +49,6 @@ RSpec.describe Mutations::DastScannerProfiles::Update do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when user can not run a DAST scan' do
-        it 'raises an exception' do
-          project.add_guest(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
       context 'when the user can run a DAST scan' do
         before do
           project.add_developer(user)
@@ -108,14 +96,6 @@ RSpec.describe Mutations::DastScannerProfiles::Update do
             expect(subject[:errors]).to include('Scanner profile not found for given parameters')
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_site_profiles/create_spec.rb

@@ -17,6 +17,8 @@ RSpec.describe Mutations::DastSiteProfiles::Create do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -35,28 +37,6 @@ RSpec.describe Mutations::DastSiteProfiles::Create do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'returns the dast_site_profile id' do
-          group.add_owner(user)
-
-          expect(subject[:id]).to eq(dast_site_profile.to_global_id)
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'returns the dast_site_profile id' do
-          project.add_maintainer(user)
-
-          expect(subject[:id]).to eq(dast_site_profile.to_global_id)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -89,14 +69,6 @@ RSpec.describe Mutations::DastSiteProfiles::Create do
             expect(response[:errors]).to include('Name has already been taken')
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_site_profiles/delete_spec.rb

@@ -15,6 +15,8 @@ RSpec.describe Mutations::DastSiteProfiles::Delete do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -32,52 +34,6 @@ RSpec.describe Mutations::DastSiteProfiles::Delete do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'has no errors' do
-          group.add_owner(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'has no errors' do
-          project.add_maintainer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a developer' do
-        it 'has no errors' do
-          project.add_developer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a reporter' do
-        it 'raises an exception' do
-          project.add_reporter(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is a guest' do
-        it 'raises an exception' do
-          project.add_guest(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -96,14 +52,6 @@ RSpec.describe Mutations::DastSiteProfiles::Delete do
             expect(subject[:errors]).to include('Name is weird')
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_site_profiles/update_spec.rb

@@ -18,6 +18,8 @@ RSpec.describe Mutations::DastSiteProfiles::Update do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -37,52 +39,6 @@ RSpec.describe Mutations::DastSiteProfiles::Update do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'has no errors' do
-          group.add_owner(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'has no errors' do
-          project.add_maintainer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a developer' do
-        it 'has no errors' do
-          project.add_developer(user)
-
-          expect(subject[:errors]).to be_empty
-        end
-      end
-
-      context 'when the user is a reporter' do
-        it 'raises an exception' do
-          project.add_reporter(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is a guest' do
-        it 'raises an exception' do
-          project.add_guest(user)
-
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -96,14 +52,6 @@ RSpec.describe Mutations::DastSiteProfiles::Update do
             expect(dast_site_profile.dast_site.url).to eq(new_target_url)
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_site_tokens/create_spec.rb

@@ -18,6 +18,8 @@ RSpec.describe Mutations::DastSiteTokens::Create do
     allow(SecureRandom).to receive(:uuid).and_return(uuid)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -35,28 +37,6 @@ RSpec.describe Mutations::DastSiteTokens::Create do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'returns the dast_site_token id' do
-          group.add_owner(user)
-
-          expect(subject[:id]).to eq(dast_site_token.to_global_id)
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'returns the dast_site_token id' do
-          project.add_maintainer(user)
-
-          expect(subject[:id]).to eq(dast_site_token.to_global_id)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -94,14 +74,6 @@ RSpec.describe Mutations::DastSiteTokens::Create do
             expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/graphql/mutations/dast_site_validations/create_spec.rb

@@ -17,6 +17,8 @@ RSpec.describe Mutations::DastSiteValidations::Create do
     stub_licensed_features(security_on_demand_scans: true)
   end
 
+  specify { expect(described_class).to require_graphql_authorizations(:create_on_demand_dast_scan) }
+
   describe '#resolve' do
     subject do
       mutation.resolve(
@@ -36,28 +38,6 @@ RSpec.describe Mutations::DastSiteValidations::Create do
         end
       end
 
-      context 'when the user is not associated with the project' do
-        it 'raises an exception' do
-          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-        end
-      end
-
-      context 'when the user is an owner' do
-        it 'returns the dast_site_validation id' do
-          group.add_owner(user)
-
-          expect(subject[:id]).to eq(dast_site_validation.to_global_id)
-        end
-      end
-
-      context 'when the user is a maintainer' do
-        it 'returns the dast_site_validation id' do
-          project.add_maintainer(user)
-
-          expect(subject[:id]).to eq(dast_site_validation.to_global_id)
-        end
-      end
-
       context 'when the user can run a dast scan' do
         before do
           project.add_developer(user)
@@ -78,14 +58,6 @@ RSpec.describe Mutations::DastSiteValidations::Create do
             expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
           end
         end
-
-        context 'when on demand scan licensed feature is not available' do
-          it 'raises an exception' do
-            stub_licensed_features(security_on_demand_scans: false)
-
-            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-          end
-        end
       end
     end
   end

ee/spec/lib/gitlab/ci/parsers/security/common_spec.rb

@@ -78,5 +78,16 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Common do
         expect(empty_report.scan).to be(nil)
       end
     end
+
+    context 'parsing links' do
+      it 'returns links object for each finding', :aggregate_failures do
+        links = report.findings.flat_map(&:links)
+
+        expect(links.map(&:url)).to match_array(['https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1020', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1030'])
+        expect(links.map(&:name)).to match_array([nil, 'CVE-1030'])
+        expect(links.size).to eq(2)
+        expect(links.first).to be_a(::Gitlab::Ci::Reports::Security::Link)
+      end
+    end
   end
 end

ee/spec/lib/gitlab/ci/reports/security/finding_spec.rb

@@ -10,6 +10,7 @@ RSpec.describe Gitlab::Ci::Reports::Security::Finding do
 
     let(:primary_identifier) { create(:ci_reports_security_identifier) }
     let(:other_identifier) { create(:ci_reports_security_identifier) }
+    let(:link) { create(:ci_reports_security_link) }
     let(:scanner) { create(:ci_reports_security_scanner) }
     let(:location) { create(:ci_reports_security_locations_sast) }
 
@@ -18,6 +19,7 @@ RSpec.describe Gitlab::Ci::Reports::Security::Finding do
         compare_key: 'this_is_supposed_to_be_a_unique_value',
         confidence: :medium,
         identifiers: [primary_identifier, other_identifier],
+        links: [link],
         location: location,
         metadata_version: 'sast:1.0',
         name: 'Cipher with no integrity',
@@ -39,6 +41,7 @@ RSpec.describe Gitlab::Ci::Reports::Security::Finding do
           confidence: :medium,
           project_fingerprint: '9a73f32d58d87d94e3dc61c4c1a94803f6014258',
           identifiers: [primary_identifier, other_identifier],
+          links: [link],
           location: location,
           metadata_version: 'sast:1.0',
           name: 'Cipher with no integrity',
@@ -84,6 +87,7 @@ RSpec.describe Gitlab::Ci::Reports::Security::Finding do
         compare_key: occurrence.compare_key,
         confidence: occurrence.confidence,
         identifiers: occurrence.identifiers,
+        links: occurrence.links,
         location: occurrence.location,
         metadata_version: occurrence.metadata_version,
         name: occurrence.name,

ee/spec/lib/gitlab/ci/reports/security/link_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Ci::Reports::Security::Link do
+  subject(:security_link) { described_class.new(name: 'CVE-2020-0202', url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0202') }
+
+  describe '#initialize' do
+    context 'when all params are given' do
+      it 'initializes an instance' do
+        expect { subject }.not_to raise_error
+
+        expect(subject).to have_attributes(
+          name: 'CVE-2020-0202',
+          url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0202'
+        )
+      end
+    end
+
+    describe '#to_hash' do
+      it 'returns expected hash' do
+        expect(security_link.to_hash).to eq(
+          {
+            name: 'CVE-2020-0202',
+            url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0202'
+          }
+        )
+      end
+    end
+  end
+end

ee/spec/models/vulnerabilities/finding_link_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Vulnerabilities::FindingLink do
+  describe 'associations' do
+    it { is_expected.to belong_to(:finding).class_name('Vulnerabilities::Finding') }
+  end
+
+  describe 'validations' do
+    let_it_be(:link) { create(:finding_link) }
+
+    it { is_expected.to validate_presence_of(:url) }
+    it { is_expected.to validate_length_of(:url).is_at_most(255) }
+    it { is_expected.to validate_length_of(:name).is_at_most(2048) }
+    it { is_expected.to validate_presence_of(:finding) }
+  end
+end

ee/spec/models/vulnerabilities/finding_spec.rb

@@ -16,6 +16,7 @@ RSpec.describe Vulnerabilities::Finding do
     it { is_expected.to have_many(:finding_pipelines).class_name('Vulnerabilities::FindingPipeline').with_foreign_key('occurrence_id') }
     it { is_expected.to have_many(:identifiers).class_name('Vulnerabilities::Identifier') }
     it { is_expected.to have_many(:finding_identifiers).class_name('Vulnerabilities::FindingIdentifier').with_foreign_key('occurrence_id') }
+    it { is_expected.to have_many(:finding_links).class_name('Vulnerabilities::FindingLink').with_foreign_key('vulnerability_occurrence_id') }
   end
 
   describe 'validations' do
@@ -405,6 +406,33 @@ RSpec.describe Vulnerabilities::Finding do
     end
   end
 
+  describe '#links' do
+    let_it_be(:finding, reload: true) do
+      create(
+        :vulnerabilities_finding,
+        raw_metadata: {
+          links: [{ url: 'https://raw.gitlab.com', name: 'raw_metadata_link' }]
+        }.to_json
+      )
+    end
+
+    subject(:links) { finding.links }
+
+    context 'when there are no finding links' do
+      it 'returns links from raw_metadata' do
+        expect(links).to eq([{ 'url' => 'https://raw.gitlab.com', 'name' => 'raw_metadata_link' }])
+      end
+    end
+
+    context 'when there are finding links assigned to given finding' do
+      let_it_be(:finding_link) { create(:finding_link, name: 'finding_link', url: 'https://link.gitlab.com', finding: finding) }
+
+      it 'returns links from finding link' do
+        expect(links).to eq([{ 'url' => 'https://link.gitlab.com', 'name' => 'finding_link' }])
+      end
+    end
+  end
+
   describe 'feedback' do
     let_it_be(:project) { create(:project) }
     let(:finding) do

ee/spec/policies/dast_scanner_profile_policy_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe DastScannerProfilePolicy do
+  it_behaves_like 'a dast on-demand scan policy' do
+    let_it_be(:record) { create(:dast_scanner_profile, project: project) }
+  end
+end

ee/spec/policies/dast_site_profile_policy_spec.rb

@@ -3,43 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe DastSiteProfilePolicy do
-  describe 'create_on_demand_dast_scan' do
-    let(:dast_site_profile) { create(:dast_site_profile) }
-    let(:project) { dast_site_profile.project }
-    let(:user) { create(:user) }
-
-    subject { described_class.new(user, dast_site_profile) }
-
-    before do
-      stub_licensed_features(security_on_demand_scans: true)
-    end
-
-    context 'when a user does not have access to the project' do
-      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-    end
-
-    context 'when a user does not have access to dast_site_profiles' do
-      before do
-        project.add_guest(user)
-      end
-
-      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-    end
-
-    context 'when a user has access dast_site_profiles' do
-      before do
-        project.add_developer(user)
-      end
-
-      it { is_expected.to be_allowed(:create_on_demand_dast_scan) }
-
-      context 'when on demand scan licensed feature is not available' do
-        before do
-          stub_licensed_features(security_on_demand_scans: false)
-        end
-
-        it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-      end
-    end
+  it_behaves_like 'a dast on-demand scan policy' do
+    let_it_be(:record) { create(:dast_site_profile, project: project) }
   end
 end

ee/spec/policies/dast_site_validation_policy_spec.rb

@@ -3,43 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe DastSiteValidationPolicy do
-  describe 'create_on_demand_dast_scan' do
-    let_it_be(:dast_site_validation, reload: true) { create(:dast_site_validation) }
-    let_it_be(:project) { dast_site_validation.dast_site_token.project }
-    let_it_be(:user) { create(:user) }
-
-    subject { described_class.new(user, dast_site_validation) }
-
-    before do
-      stub_licensed_features(security_on_demand_scans: true)
-    end
-
-    context 'when a user does not have access to the project' do
-      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-    end
-
-    context 'when a user does not have access to dast_site_validations' do
-      before do
-        project.add_guest(user)
-      end
-
-      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-    end
-
-    context 'when a user has access dast_site_validations' do
-      before do
-        project.add_developer(user)
-      end
-
-      it { is_expected.to be_allowed(:create_on_demand_dast_scan) }
-
-      context 'when on demand scan licensed feature is not available' do
-        before do
-          stub_licensed_features(security_on_demand_scans: false)
-        end
-
-        it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
-      end
-    end
+  it_behaves_like 'a dast on-demand scan policy' do
+    let_it_be(:record) { create(:dast_site_validation, dast_site_token: create(:dast_site_token, project: project)) }
   end
 end

ee/spec/services/ee/issues/create_from_vulnerability_data_service_spec.rb

@@ -37,7 +37,7 @@ RSpec.describe Issues::CreateFromVulnerabilityDataService, '#execute' do
 
     it 'returns expected error' do
       expect(result[:status]).to eq(:error)
-      expect(result[:message]).to eq("Can't create issue")
+      expect(result[:message]).to eq("User is not permitted to create issue")
     end
   end
 
@@ -47,7 +47,7 @@ RSpec.describe Issues::CreateFromVulnerabilityDataService, '#execute' do
 
     it 'returns expected error' do
       expect(result[:status]).to eq(:error)
-      expect(result[:message]).to eq("Can't create issue")
+      expect(result[:message]).to eq("User is not permitted to create issue")
     end
   end
 

ee/spec/services/ee/issues/create_from_vulnerability_service_spec.rb

@@ -80,7 +80,7 @@ RSpec.describe Issues::CreateFromVulnerabilityService, '#execute' do
 
       it 'returns expected error' do
         expect(result[:status]).to eq(:error)
-        expect(result[:message]).to eq("Can't create issue")
+        expect(result[:message]).to eq("User is not permitted to create issue")
       end
     end
 
@@ -89,7 +89,7 @@ RSpec.describe Issues::CreateFromVulnerabilityService, '#execute' do
 
       it 'returns expected error' do
         expect(result[:status]).to eq(:error)
-        expect(result[:message]).to eq("Can't create issue")
+        expect(result[:message]).to eq("User is not permitted to create issue")
       end
     end
 

ee/spec/services/ee/merge_requests/create_from_vulnerability_data_service_spec.rb

@@ -43,7 +43,7 @@ RSpec.describe MergeRequests::CreateFromVulnerabilityDataService, '#execute' do
 
     it 'returns expected error' do
       expect(result[:status]).to eq(:error)
-      expect(result[:message]).to eq("Can't create merge_request")
+      expect(result[:message]).to eq("User is not permitted to create merge request")
     end
   end
 
@@ -53,7 +53,7 @@ RSpec.describe MergeRequests::CreateFromVulnerabilityDataService, '#execute' do
 
     it 'returns expected error' do
       expect(result[:status]).to eq(:error)
-      expect(result[:message]).to eq("Can't create merge_request")
+      expect(result[:message]).to eq("User is not permitted to create merge request")
     end
   end
 
@@ -213,7 +213,7 @@ RSpec.describe MergeRequests::CreateFromVulnerabilityDataService, '#execute' do
 
       it 'return expected error' do
         expect(result[:status]).to eq(:error)
-        expect(result[:message]).to eq("Can't create merge request")
+        expect(result[:message]).to eq("No remediations available for merge request")
       end
     end
   end

ee/spec/services/security/store_report_service_spec.rb

@@ -2,6 +2,19 @@
 
 require 'spec_helper'
 
+UUID_REGEXP = Regexp.new("^([0-9a-f]{8})-([0-9a-f]{4})-([0-9a-f]{4})-" \
+                         "([0-9a-f]{2})([0-9a-f]{2})-([0-9a-f]{12})$").freeze
+
+RSpec::Matchers.define :be_uuid_v5 do
+  match do |string|
+    expect(string).to be_a(String)
+
+    uuid_components = string.downcase.scan(UUID_REGEXP).first
+    time_hi_and_version = uuid_components[2].to_i(16)
+    (time_hi_and_version >> 12) == 5
+  end
+end
+
 RSpec.describe Security::StoreReportService, '#execute' do
   let_it_be(:user) { create(:user) }
   let(:artifact) { create(:ee_ci_job_artifact, trait) }
@@ -24,11 +37,11 @@ RSpec.describe Security::StoreReportService, '#execute' do
 
     using RSpec::Parameterized::TableSyntax
 
-    where(:case_name, :trait, :scanners, :identifiers, :findings, :finding_identifiers, :finding_pipelines) do
-      'with SAST report'                | :sast                       | 3 | 17 | 33 | 39 | 33
-      'with exceeding identifiers'      | :with_exceeding_identifiers | 1 | 20 | 1  | 20 | 1
-      'with Dependency Scanning report' | :dependency_scanning        | 2 | 7  | 4  | 7  | 4
-      'with Container Scanning report'  | :container_scanning         | 1 | 8  | 8  | 8  | 8
+    where(:case_name, :trait, :scanners, :identifiers, :findings, :finding_identifiers, :finding_pipelines, :finding_links) do
+      'with SAST report'                | :sast                       | 3 | 17 | 33 | 39 | 33 | 0
+      'with exceeding identifiers'      | :with_exceeding_identifiers | 1 | 20 | 1  | 20 | 1  | 0
+      'with Dependency Scanning report' | :dependency_scanning        | 2 | 7  | 4  | 7  | 4  | 6
+      'with Container Scanning report'  | :container_scanning         | 1 | 8  | 8  | 8  | 8  | 8
     end
 
     with_them do
@@ -57,7 +70,9 @@ RSpec.describe Security::StoreReportService, '#execute' do
       end
 
       it 'calculates UUIDv5 for all findings' do
-        expect(Vulnerabilities::Finding.pluck(:uuid)).to all(be_a(String))
+        subject
+        uuids = Vulnerabilities::Finding.pluck(:uuid)
+        expect(uuids).to all(be_uuid_v5)
       end
     end
 

ee/spec/support/shared_examples/policies/dast_on_demand_scans_shared_examples.rb

+# frozen_string_literal: true
+
+RSpec.shared_examples 'a dast on-demand scan policy' do
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project) { create(:project, group: group) }
+  let_it_be(:user) { create(:user) }
+
+  subject { described_class.new(user, record) }
+
+  before do
+    stub_licensed_features(security_on_demand_scans: true)
+  end
+
+  describe 'create_on_demand_dast_scan' do
+    context 'when a user does not have access to the project' do
+      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is a guest' do
+      before do
+        project.add_guest(user)
+      end
+
+      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is a reporter' do
+      before do
+        project.add_reporter(user)
+      end
+
+      it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is a developer' do
+      before do
+        project.add_developer(user)
+      end
+
+      it { is_expected.to be_allowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is a maintainer' do
+      before do
+        project.add_maintainer(user)
+      end
+
+      it { is_expected.to be_allowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is an owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it { is_expected.to be_allowed(:create_on_demand_dast_scan) }
+    end
+
+    context 'when the user is allowed' do
+      before do
+        project.add_developer(user)
+      end
+
+      context 'when on demand scan licensed feature is not available' do
+        let(:project) { create(:project, group: group) } # allows license stub to work correctly
+
+        before do
+          stub_licensed_features(security_on_demand_scans: false)
+        end
+
+        it { is_expected.to be_disallowed(:create_on_demand_dast_scan) }
+      end
+    end
+  end
+end

lib/api/api.rb

@@ -186,6 +186,7 @@ module API
       mount ::API::ImportBitbucketServer
       mount ::API::ImportGithub
       mount ::API::IssueLinks
+      mount ::API::Invitations
       mount ::API::Issues
       mount ::API::JobArtifacts
       mount ::API::Jobs

lib/api/entities/invitation.rb

+# frozen_string_literal: true
+
+module API
+  module Entities
+    class Invitation < Grape::Entity
+      expose :access_level
+      expose :requested_at
+      expose :expires_at
+      expose :invite_email
+      expose :invite_token
+      expose :user_id
+    end
+  end
+end

lib/api/invitations.rb

+# frozen_string_literal: true
+
+module API
+  class Invitations < ::API::Base
+    feature_category :users
+
+    before { authenticate! }
+
+    helpers ::API::Helpers::MembersHelpers
+
+    %w[group project].each do |source_type|
+      params do
+        requires :id, type: String, desc: "The #{source_type} ID"
+      end
+      resource source_type.pluralize, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
+        desc 'Invite non-members by email address to a group or project.' do
+          detail 'This feature was introduced in GitLab 13.6'
+          success Entities::Invitation
+        end
+        params do
+          requires :email, types: [String, Array[String]], email_or_email_list: true, desc: 'The email address to invite, or multiple emails separated by comma'
+          requires :access_level, type: Integer, values: Gitlab::Access.all_values, desc: 'A valid access level (defaults: `30`, developer access level)'
+          optional :expires_at, type: DateTime, desc: 'Date string in the format YEAR-MONTH-DAY'
+        end
+        post ":id/invitations" do
+          source = find_source(source_type, params[:id])
+
+          authorize_admin_source!(source_type, source)
+
+          ::Members::InviteService.new(current_user, params).execute(source)
+        end
+      end
+    end
+  end
+end

lib/api/validations/validators/email_or_email_list.rb

+# frozen_string_literal: true
+
+module API
+  module Validations
+    module Validators
+      class EmailOrEmailList < Grape::Validations::Base
+        def validate_param!(attr_name, params)
+          value = params[attr_name]
+
+          return unless value
+
+          return if value.split(',').map { |v| ValidateEmail.valid?(v) }.all?
+
+          raise Grape::Exceptions::Validation,
+            params: [@scope.full_name(attr_name)],
+            message: "contains an invalid email address"
+        end
+      end
+    end
+  end
+end

lib/gitlab/path_regex.rb

@@ -49,6 +49,7 @@ module Gitlab
       s
       search
       sent_notifications
+      sitemap
       sitemap.xml
       sitemap.xml.gz
       slash-command-logo.png

lib/gitlab/usage_data.rb

@@ -160,6 +160,7 @@ module Gitlab
             projects_with_tracing_enabled: count(ProjectTracingSetting),
             projects_with_error_tracking_enabled: count(::ErrorTracking::ProjectErrorTrackingSetting.where(enabled: true)),
             projects_with_alerts_service_enabled: count(AlertsService.active),
+            projects_with_alerts_created: distinct_count(::AlertManagement::Alert, :project_id),
             projects_with_prometheus_alerts: distinct_count(PrometheusAlert, :project_id),
             projects_with_terraform_reports: distinct_count(::Ci::JobArtifact.terraform_reports, :project_id),
             projects_with_terraform_states: distinct_count(::Terraform::State, :project_id),
@@ -215,7 +216,8 @@ module Gitlab
             # rubocop: enable UsageData/LargeTable:
             packages: count(::Packages::Package.where(last_28_days_time_period)),
             personal_snippets: count(PersonalSnippet.where(last_28_days_time_period)),
-            project_snippets: count(ProjectSnippet.where(last_28_days_time_period))
+            project_snippets: count(ProjectSnippet.where(last_28_days_time_period)),
+            projects_with_alerts_created: distinct_count(::AlertManagement::Alert.where(last_28_days_time_period), :project_id)
           }.merge(
             snowplow_event_counts(last_28_days_time_period(column: :collector_tstamp)),
             aggregated_metrics_monthly

locale/gitlab.pot

@@ -9866,6 +9866,9 @@ msgstr ""
 msgid "Email Notification"
 msgstr ""
 
+msgid "Email cannot be blank"
+msgstr ""
+
 msgid "Email could not be sent"
 msgstr ""
 
@@ -28202,6 +28205,9 @@ msgstr ""
 msgid "Too many projects enabled. You will need to manage them via the console or the API."
 msgstr ""
 
+msgid "Too many users specified (limit is %{user_limit})"
+msgstr ""
+
 msgid "Too much data"
 msgstr ""
 

spec/frontend/vue_shared/components/filtered_search_bar/tokens/milestone_token_spec.js

@@ -120,7 +120,9 @@ describe('MilestoneToken', () => {
         wrapper.vm.fetchMilestoneBySearchTerm('foo');
 
         return waitForPromises().then(() => {
-          expect(createFlash).toHaveBeenCalledWith('There was a problem fetching milestones.');
+          expect(createFlash).toHaveBeenCalledWith({
+            message: 'There was a problem fetching milestones.',
+          });
         });
       });
 

spec/graphql/types/group_invitation_type_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Types::GroupInvitationType do
+  specify { expect(described_class).to expose_permissions_using(Types::PermissionTypes::Group) }
+
+  specify { expect(described_class.graphql_name).to eq('GroupInvitation') }
+
+  specify { expect(described_class).to require_graphql_authorizations(:read_group) }
+
+  it 'has the expected fields' do
+    expected_fields = %w[
+      email access_level created_by created_at updated_at expires_at group
+    ]
+
+    expect(described_class).to include_graphql_fields(*expected_fields)
+  end
+end

spec/graphql/types/invitation_interface_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Types::InvitationInterface do
+  it 'exposes the expected fields' do
+    expected_fields = %i[
+      email
+      access_level
+      created_by
+      created_at
+      updated_at
+      expires_at
+      user
+    ]
+
+    expect(described_class).to have_graphql_fields(*expected_fields)
+  end
+
+  describe '.resolve_type' do
+    subject { described_class.resolve_type(object, {}) }
+
+    context 'for project member' do
+      let(:object) { build(:project_member) }
+
+      it { is_expected.to be Types::ProjectInvitationType }
+    end
+
+    context 'for group member' do
+      let(:object) { build(:group_member) }
+
+      it { is_expected.to be Types::GroupInvitationType }
+    end
+
+    context 'for an unknown type' do
+      let(:object) { build(:user) }
+
+      it 'raises an error' do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::BaseError)
+      end
+    end
+  end
+end

spec/graphql/types/project_invitation_type_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Types::ProjectInvitationType do
+  specify { expect(described_class).to expose_permissions_using(Types::PermissionTypes::Project) }
+
+  specify { expect(described_class.graphql_name).to eq('ProjectInvitation') }
+
+  specify { expect(described_class).to require_graphql_authorizations(:read_project) }
+
+  it 'has the expected fields' do
+    expected_fields = %w[
+      access_level created_by created_at updated_at expires_at project user
+    ]
+
+    expect(described_class).to include_graphql_fields(*expected_fields)
+  end
+end

spec/lib/api/validations/validators/email_or_email_list_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Validations::Validators::EmailOrEmailList do
+  include ApiValidatorsHelpers
+
+  subject do
+    described_class.new(['email'], {}, false, scope.new)
+  end
+
+  context 'with valid email addresses' do
+    it 'does not raise a validation error' do
+      expect_no_validation_error('test' => 'test@example.org')
+      expect_no_validation_error('test' => 'test1@example.com,test2@example.org')
+      expect_no_validation_error('test' => 'test1@example.com,test2@example.org,test3@example.co.uk')
+    end
+  end
+
+  context 'including any invalid email address' do
+    it 'raises a validation error' do
+      expect_validation_error('test' => 'not')
+      expect_validation_error('test' => '@example.com')
+      expect_validation_error('test' => 'test1@example.com,asdf')
+      expect_validation_error('test' => 'asdf,testa1@example.com,asdf')
+    end
+  end
+end

spec/lib/gitlab/path_regex_spec.rb

@@ -107,7 +107,7 @@ RSpec.describe Gitlab::PathRegex do
   end
 
   let(:sitemap_words) do
-    %w(sitemap.xml sitemap.xml.gz)
+    %w(sitemap sitemap.xml sitemap.xml.gz)
   end
 
   let(:ee_top_level_words) do
@@ -177,7 +177,7 @@ RSpec.describe Gitlab::PathRegex do
 
     # We ban new items in this list, see https://gitlab.com/gitlab-org/gitlab/-/issues/215362
     it 'does not allow expansion' do
-      expect(described_class::TOP_LEVEL_ROUTES.size).to eq(43)
+      expect(described_class::TOP_LEVEL_ROUTES.size).to eq(44)
     end
   end
 

spec/lib/gitlab/usage_data_spec.rb

@@ -308,6 +308,7 @@ RSpec.describe Gitlab::UsageData, :aggregate_failures do
         projects_with_tracing_enabled: 2,
         projects_with_error_tracking_enabled: 2
       )
+
       expect(described_class.usage_activity_by_stage_monitor(described_class.last_28_days_time_period)).to include(
         clusters: 1,
         clusters_applications_prometheus: 1,
@@ -470,6 +471,7 @@ RSpec.describe Gitlab::UsageData, :aggregate_failures do
       expect(count_data[:projects_with_prometheus_alerts]).to eq(2)
       expect(count_data[:projects_with_terraform_reports]).to eq(2)
       expect(count_data[:projects_with_terraform_states]).to eq(2)
+      expect(count_data[:projects_with_alerts_created]).to eq(1)
       expect(count_data[:protected_branches]).to eq(2)
       expect(count_data[:protected_branches_except_default]).to eq(1)
       expect(count_data[:terraform_reports]).to eq(6)
@@ -611,6 +613,7 @@ RSpec.describe Gitlab::UsageData, :aggregate_failures do
         create(:deployment, :success, deployment_options)
         create(:project_snippet, project: project, created_at: n.days.ago)
         create(:personal_snippet, created_at: n.days.ago)
+        create(:alert_management_alert, project: project, created_at: n.days.ago)
       end
 
       stub_application_setting(self_monitoring_project: project)
@@ -631,6 +634,7 @@ RSpec.describe Gitlab::UsageData, :aggregate_failures do
       expect(counts_monthly[:snippets]).to eq(2)
       expect(counts_monthly[:personal_snippets]).to eq(1)
       expect(counts_monthly[:project_snippets]).to eq(1)
+      expect(counts_monthly[:projects_with_alerts_created]).to eq(1)
       expect(counts_monthly[:packages]).to eq(1)
       expect(counts_monthly[:promoted_issues]).to eq(1)
     end

spec/migrations/rename_sitemap_namespace_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+require Rails.root.join('db', 'post_migrate', '20201102112206_rename_sitemap_namespace.rb')
+
+RSpec.describe RenameSitemapNamespace do
+  let(:namespaces) { table(:namespaces) }
+  let(:routes) { table(:routes) }
+  let(:sitemap_path) { 'sitemap' }
+
+  it 'correctly run #up and #down' do
+    create_namespace(sitemap_path)
+
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(namespaces.pluck(:path)).to contain_exactly(sitemap_path)
+      }
+
+      migration.after -> {
+        expect(namespaces.pluck(:path)).to contain_exactly(sitemap_path + '0')
+      }
+    end
+  end
+
+  def create_namespace(path)
+    namespaces.create!(name: path, path: path).tap do |namespace|
+      routes.create!(path: namespace.path, name: namespace.name, source_id: namespace.id, source_type: 'Namespace')
+    end
+  end
+end

spec/models/concerns/from_union_spec.rb

@@ -3,13 +3,5 @@
 require 'spec_helper'
 
 RSpec.describe FromUnion do
-  [true, false].each do |sql_set_operator|
-    context "when sql-set-operators feature flag is #{sql_set_operator}" do
-      before do
-        stub_feature_flags(sql_set_operators: sql_set_operator)
-      end
-
-      it_behaves_like 'from set operator', Gitlab::SQL::Union
-    end
-  end
+  it_behaves_like 'from set operator', Gitlab::SQL::Union
 end

spec/models/deployment_spec.rb

@@ -114,14 +114,6 @@ RSpec.describe Deployment do
         deployment.run!
       end
 
-      it 'does not execute Deployments::ExecuteHooksWorker when feature is disabled' do
-        stub_feature_flags(ci_send_deployment_hook_when_start: false)
-        expect(Deployments::ExecuteHooksWorker)
-            .not_to receive(:perform_async).with(deployment.id)
-
-        deployment.run!
-      end
-
       it 'executes Deployments::DropOlderDeploymentsWorker asynchronously' do
         expect(Deployments::DropOlderDeploymentsWorker)
             .to receive(:perform_async).once.with(deployment.id)

spec/requests/api/invitations_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Invitations do
+  let(:maintainer) { create(:user, username: 'maintainer_user') }
+  let(:developer) { create(:user) }
+  let(:access_requester) { create(:user) }
+  let(:stranger) { create(:user) }
+  let(:email) { 'email@example.org' }
+
+  let(:project) do
+    create(:project, :public, creator_id: maintainer.id, namespace: maintainer.namespace) do |project|
+      project.add_developer(developer)
+      project.add_maintainer(maintainer)
+      project.request_access(access_requester)
+    end
+  end
+
+  let!(:group) do
+    create(:group, :public) do |group|
+      group.add_developer(developer)
+      group.add_owner(maintainer)
+      group.request_access(access_requester)
+    end
+  end
+
+  def invitations_url(source, user)
+    api("/#{source.model_name.plural}/#{source.id}/invitations", user)
+  end
+
+  shared_examples 'POST /:source_type/:id/invitations' do |source_type|
+    context "with :source_type == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) do
+          post invitations_url(source, stranger),
+               params: { email: email, access_level: Member::MAINTAINER }
+        end
+      end
+
+      context 'when authenticated as a non-member or member with insufficient rights' do
+        %i[access_requester stranger developer].each do |type|
+          context "as a #{type}" do
+            it 'returns 403' do
+              user = public_send(type)
+
+              post invitations_url(source, user), params: { email: email, access_level: Member::MAINTAINER }
+
+              expect(response).to have_gitlab_http_status(:forbidden)
+            end
+          end
+        end
+      end
+
+      context 'when authenticated as a maintainer/owner' do
+        context 'and new member is already a requester' do
+          it 'does not transform the requester into a proper member' do
+            expect do
+              post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+                   params: { email: email, access_level: Member::MAINTAINER }
+
+              expect(response).to have_gitlab_http_status(:created)
+            end.not_to change { source.members.count }
+          end
+        end
+
+        it 'invites a new member' do
+          expect do
+            post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+                 params: { email: email, access_level: Member::DEVELOPER }
+
+            expect(response).to have_gitlab_http_status(:created)
+          end.to change { source.requesters.count }.by(1)
+        end
+
+        it 'invites a list of new email addresses' do
+          expect do
+            email_list = 'email1@example.com,email2@example.com'
+
+            post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+                 params: { email: email_list, access_level: Member::DEVELOPER }
+
+            expect(response).to have_gitlab_http_status(:created)
+          end.to change { source.requesters.count }.by(2)
+        end
+      end
+
+      context 'access levels' do
+        it 'does not create the member if group level is higher' do
+          parent = create(:group)
+
+          group.update!(parent: parent)
+          project.update!(group: group)
+          parent.add_developer(stranger)
+
+          post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+               params: { email: stranger.email, access_level: Member::REPORTER }
+
+          expect(response).to have_gitlab_http_status(:created)
+          expect(json_response['message'][stranger.email]).to eq("Access level should be greater than or equal to Developer inherited membership from group #{parent.name}")
+        end
+
+        it 'creates the member if group level is lower' do
+          parent = create(:group)
+
+          group.update!(parent: parent)
+          project.update!(group: group)
+          parent.add_developer(stranger)
+
+          post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+               params: { email: stranger.email, access_level: Member::MAINTAINER }
+
+          expect(response).to have_gitlab_http_status(:created)
+        end
+      end
+
+      context 'access expiry date' do
+        subject do
+          post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+               params: { email: email, access_level: Member::DEVELOPER, expires_at: expires_at }
+        end
+
+        context 'when set to a date in the past' do
+          let(:expires_at) { 2.days.ago.to_date }
+
+          it 'does not create a member' do
+            expect do
+              subject
+            end.not_to change { source.members.count }
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response['message'][email]).to eq('Expires at cannot be a date in the past')
+          end
+        end
+
+        context 'when set to a date in the future' do
+          let(:expires_at) { 2.days.from_now.to_date }
+
+          it 'invites a member' do
+            expect do
+              subject
+            end.to change { source.requesters.count }.by(1)
+
+            expect(response).to have_gitlab_http_status(:created)
+          end
+        end
+      end
+
+      it "returns a message if member already exists" do
+        post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+             params: { email: maintainer.email, access_level: Member::MAINTAINER }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response['message'][maintainer.email]).to eq("Already a member of #{source.name}")
+      end
+
+      it 'returns 404 when the email is not valid' do
+        post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+             params: { email: '', access_level: Member::MAINTAINER }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response['message']).to eq('Email cannot be blank')
+      end
+
+      it 'returns 404 when the email list is not a valid format' do
+        post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+             params: { email: 'email1@example.com,not-an-email', access_level: Member::MAINTAINER }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+        expect(json_response['error']).to eq('email contains an invalid email address')
+      end
+
+      it 'returns 400 when email is not given' do
+        post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+             params: { access_level: Member::MAINTAINER }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+
+      it 'returns 400 when access_level is not given' do
+        post api("/#{source_type.pluralize}/#{source.id}/invitations", maintainer),
+             params: { email: email }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+
+      it 'returns 400 when access_level is not valid' do
+        post invitations_url(source, maintainer),
+             params: { email: email, access_level: non_existing_record_access_level }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+  end
+
+  describe 'POST /projects/:id/invitations' do
+    it_behaves_like 'POST /:source_type/:id/invitations', 'project' do
+      let(:source) { project }
+    end
+  end
+
+  describe 'POST /groups/:id/invitations' do
+    it_behaves_like 'POST /:source_type/:id/invitations', 'group' do
+      let(:source) { group }
+    end
+  end
+end

spec/services/members/invite_service_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Members::InviteService do
+  let(:project) { create(:project) }
+  let(:user) { create(:user) }
+  let(:project_user) { create(:user) }
+
+  before do
+    project.add_maintainer(user)
+  end
+
+  it 'adds an existing user to members' do
+    params = { email: project_user.email.to_s, access_level: Gitlab::Access::GUEST }
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:success)
+    expect(project.users).to include project_user
+  end
+
+  it 'creates a new user for an unknown email address' do
+    params = { email: 'email@example.org', access_level: Gitlab::Access::GUEST }
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:success)
+  end
+
+  it 'limits the number of emails to 100' do
+    emails = Array.new(101).map { |n| "email#{n}@example.com" }
+    params = { email: emails, access_level: Gitlab::Access::GUEST }
+
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:error)
+    expect(result[:message]).to eq('Too many users specified (limit is 100)')
+  end
+
+  it 'does not invite an invalid email' do
+    params = { email: project_user.id.to_s, access_level: Gitlab::Access::GUEST }
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:error)
+    expect(result[:message][project_user.id.to_s]).to eq("Invite email is invalid")
+    expect(project.users).not_to include project_user
+  end
+
+  it 'does not invite to an invalid access level' do
+    params = { email: project_user.email, access_level: -1 }
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:error)
+    expect(result[:message][project_user.email]).to eq("Access level is not included in the list")
+  end
+
+  it 'does not add a member with an existing invite' do
+    invited_member = create(:project_member, :invited, project: project)
+
+    params = { email: invited_member.invite_email,
+               access_level: Gitlab::Access::GUEST }
+    result = described_class.new(user, params).execute(project)
+
+    expect(result[:status]).to eq(:error)
+    expect(result[:message][invited_member.invite_email]).to eq("Member already invited to #{project.name}")
+  end
+end

spec/workers/concerns/application_worker_spec.rb

@@ -45,7 +45,7 @@ RSpec.describe ApplicationWorker do
       instance.jid = 'a jid'
 
       expect(result).to include(
-        'class' => worker.class,
+        'class' => instance.class.name,
         'job_status' => 'running',
         'queue' => worker.queue,
         'jid' => instance.jid
@@ -69,7 +69,7 @@ RSpec.describe ApplicationWorker do
     it 'does not override predefined context keys with custom payload' do
       payload['class'] = 'custom value'
 
-      expect(result).to include('class' => worker.class)
+      expect(result).to include('class' => instance.class.name)
     end
   end