Merge branch 'rest_api_log_last_activity_on' into 'master'

Update last_activity_on field on every REST API request

See merge request gitlab-org/gitlab!21725

changelogs/unreleased/rest_api_log_last_activity_on.yml

+---
+title: Log user last activity on REST API
+merge_request: 21725
+author:
+type: fixed

doc/api/users.md

@@ -1376,6 +1376,7 @@ The activities that update the timestamp are:
 - Git HTTP/SSH activities (such as clone, push)
 - User logging in into GitLab
 - User visiting pages related to Dashboards, Projects, Issues and Merge Requests ([introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/54947) in GitLab 11.8)
+- User using the API
 
 By default, it shows the activity for all users in the last 6 months, but this can be
 amended by using the `from` parameter.

doc/user/instance_statistics/user_cohorts.md

@@ -26,3 +26,4 @@ How do we measure the activity of users? GitLab considers a user active if:
 - The user signs in.
 - The user has Git activity (whether push or pull).
 - The user visits pages related to Dashboards, Projects, Issues and Merge Requests ([introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/54947) in GitLab 11.8).
+- The user uses the API

ee/lib/api/epics.rb

@@ -99,6 +99,8 @@ module API
         at_least_one_of :title, :description, :start_date_fixed, :start_date_is_fixed, :due_date_fixed, :due_date_is_fixed, :labels, :state_event
       end
       put ':id/(-/)epics/:epic_iid' do
+        Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab/issues/194104')
+
         authorize_can_admin!
         update_params = declared_params(include_missing: false)
         update_params.delete(:epic_iid)

lib/api/api.rb

@@ -103,6 +103,11 @@ module API
     helpers ::API::Helpers
     helpers ::API::Helpers::CommonHelpers
 
+    namespace do
+      after do
+        ::Users::ActivityService.new(@current_user).execute if Feature.enabled?(:api_activity_logging)
+      end
+
       # Keep in alphabetical order
       mount ::API::AccessRequests
       mount ::API::Appearance
@@ -131,8 +136,6 @@ module API
       mount ::API::GroupContainerRepositories
       mount ::API::GroupVariables
       mount ::API::ImportGithub
-    mount ::API::Internal::Base
-    mount ::API::Internal::Pages
       mount ::API::Issues
       mount ::API::JobArtifacts
       mount ::API::Jobs
@@ -191,6 +194,10 @@ module API
       mount ::API::Variables
       mount ::API::Version
       mount ::API::Wikis
+    end
+
+    mount ::API::Internal::Base
+    mount ::API::Internal::Pages
 
     route :any, '*path' do
       error!('404 Not Found', 404)

spec/requests/api/api_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::API do
+  let(:user) { create(:user, last_activity_on: Date.yesterday) }
+
+  describe 'Record user last activity in after hook' do
+    # It does not matter which endpoint is used because last_activity_on should
+    # be updated on every request. `/groups` is used as an example
+    # to represent any API endpoint
+
+    it 'updates the users last_activity_on date' do
+      expect { get api('/groups', user) }.to change { user.reload.last_activity_on }.to(Date.today)
+    end
+
+    context 'when the the api_activity_logging feature is disabled' do
+      it 'does not touch last_activity_on' do
+        stub_feature_flags(api_activity_logging: false)
+
+        expect { get api('/groups', user) }.not_to change { user.reload.last_activity_on }
+      end
+    end
+  end
+end

spec/requests/api/project_container_repositories_spec.rb

@@ -148,6 +148,7 @@ describe API::ProjectContainerRepositories do
         let(:lease_key) { "container_repository:cleanup_tags:#{root_repository.id}" }
 
         it 'schedules cleanup of tags repository' do
+          stub_last_activity_update
           stub_exclusive_lease(lease_key, timeout: 1.hour)
           expect(CleanupContainerRepositoryWorker).to receive(:perform_async)
             .with(maintainer.id, root_repository.id, worker_params)

spec/support/helpers/api_helpers.rb

@@ -46,4 +46,8 @@ module ApiHelpers
     expect(json_response).to be_an Array
     expect(json_response.map { |item| item['id'] }).to eq(Array(items))
   end
+
+  def stub_last_activity_update
+    allow_any_instance_of(Users::ActivityService).to receive(:execute)
+  end
 end