app/assets/javascripts/projects/settings/branch_rules/components/view/rule_drawer.vue

@@ -40,6 +40,9 @@ export default {
     ItemsSelector: () =>
       import('ee_component/projects/settings/branch_rules/components/view/items_selector.vue'),
   },
+  inject: {
+    showEnterpriseAccessLevels: { default: false },
+  },
   props: {
     isOpen: {
       type: Boolean,
@@ -198,19 +201,21 @@ export default {
           }}
         </gl-form-checkbox>
 
-        <items-selector
-          :type="$options.USERS_TYPE"
-          :items="formatItemsIds(users)"
-          :users-options="$options.projectUsersOptions"
-          data-testid="users-selector"
-          @change="handleRuleDataUpdate('updatedUsers', $event)"
-        />
-        <items-selector
-          :type="$options.GROUPS_TYPE"
-          :items="formatItemsIds(groups)"
-          data-testid="groups-selector"
-          @change="handleRuleDataUpdate('updatedGroups', $event)"
-        />
+        <template v-if="showEnterpriseAccessLevels">
+          <items-selector
+            :type="$options.USERS_TYPE"
+            :items="formatItemsIds(users)"
+            :users-options="$options.projectUsersOptions"
+            data-testid="users-selector"
+            @change="handleRuleDataUpdate('updatedUsers', $event)"
+          />
+          <items-selector
+            :type="$options.GROUPS_TYPE"
+            :items="formatItemsIds(groups)"
+            data-testid="groups-selector"
+            @change="handleRuleDataUpdate('updatedGroups', $event)"
+          />
+        </template>
         <items-selector
           v-if="isPushAccessLevels"
           :type="$options.DEPLOY_KEYS_TYPE"

app/assets/javascripts/projects/settings/branch_rules/mount_branch_rules.js

@@ -26,6 +26,7 @@ export default function mountBranchRules(el, store) {
     showStatusChecks,
     showApprovers,
     showCodeOwners,
+    showEnterpriseAccessLevels,
     canAdminProtectedBranches,
   } = el.dataset;
 
@@ -44,6 +45,7 @@ export default function mountBranchRules(el, store) {
       showStatusChecks: parseBoolean(showStatusChecks),
       showApprovers: parseBoolean(showApprovers),
       showCodeOwners: parseBoolean(showCodeOwners),
+      showEnterpriseAccessLevels: parseBoolean(showEnterpriseAccessLevels),
       canAdminProtectedBranches: parseBoolean(canAdminProtectedBranches),
     },
     render(h) {

app/assets/javascripts/projects/settings/repository/branch_rules/app.vue

@@ -51,6 +51,8 @@ export default {
   inject: {
     projectPath: { default: '' },
     branchRulesPath: { default: '' },
+    showStatusChecks: { default: false },
+    showApprovers: { default: false },
   },
   data() {
     return {
@@ -63,13 +65,15 @@ export default {
         { text: this.$options.i18n.branchName, action: () => this.openCreateRuleModal() },
       ];
 
-      [this.$options.i18n.allBranches, this.$options.i18n.allProtectedBranches].forEach(
-        (branch) => {
-          if (!this.hasPredefinedBranchRule(branch)) {
-            items.push(this.createPredefinedBrachRulesItem(branch));
-          }
-        },
-      );
+      if (this.showApprovers || this.showStatusChecks) {
+        [this.$options.i18n.allBranches, this.$options.i18n.allProtectedBranches].forEach(
+          (branch) => {
+            if (!this.hasPredefinedBranchRule(branch)) {
+              items.push(this.createPredefinedBrachRulesItem(branch));
+            }
+          },
+        );
+      }
 
       return items;
     },

app/views/projects/branch_rules/_show.html.haml

@@ -2,6 +2,7 @@
 - show_code_owners = @project.licensed_feature_available?(:code_owner_approval_required)
 - show_status_checks = @project.licensed_feature_available?(:external_status_checks)
 - show_approvers = @project.licensed_feature_available?(:merge_request_approvers)
+- show_enterprise_access_levels = @project.licensed_feature_available?(:protected_refs_for_users)
 
 = render ::Layouts::SettingsBlockComponent.new(_('Branch rules'),
   id: 'branch-rules',
@@ -14,4 +15,4 @@
     = _('Define rules for who can push, merge, and the required approvals for each branch.')
     = link_to(_('Leave feedback.'), 'https://gitlab.com/gitlab-org/gitlab/-/issues/388149', target: '_blank', rel: 'noopener noreferrer')
   - c.with_body do
-    #js-branch-rules{ data: { project_path: @project.full_path, branch_rules_path: project_settings_repository_branch_rules_path(@project), show_code_owners: show_code_owners.to_s, show_status_checks: show_status_checks.to_s, show_approvers: show_approvers.to_s } }
+    #js-branch-rules{ data: { project_path: @project.full_path, branch_rules_path: project_settings_repository_branch_rules_path(@project), show_code_owners: show_code_owners.to_s, show_status_checks: show_status_checks.to_s, show_approvers: show_approvers.to_s, show_enterprise_access_levels: show_enterprise_access_levels.to_s } }

db/docs/dependency_list_exports.yml

@@ -7,5 +7,5 @@ feature_categories:
 description: Dependency list exported data
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/104361
 milestone: '15.7'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
 sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/454947

ee/app/helpers/ee/projects/settings/branch_rules_helper.rb

@@ -8,6 +8,7 @@ def branch_rules_data(project)
           show_status_checks = project.licensed_feature_available?(:external_status_checks)
           show_approvers = project.licensed_feature_available?(:merge_request_approvers)
           show_code_owners = project.licensed_feature_available?(:code_owner_approval_required)
+          show_enterprise_access_levels = project.licensed_feature_available?(:protected_refs_for_users)
           {
             project_path: project.full_path,
             protected_branches_path: project_settings_repository_path(project,
@@ -20,6 +21,7 @@ def branch_rules_data(project)
             show_status_checks: show_status_checks.to_s,
             show_approvers: show_approvers.to_s,
             show_code_owners: show_code_owners.to_s,
+            show_enterprise_access_levels: show_enterprise_access_levels.to_s,
             project_id: project.id,
             rules_path: expose_path(api_v4_projects_approval_rules_path(id: project.id)),
             can_edit: can?(current_user, :modify_approvers_rules, project).to_s,

ee/spec/features/projects/settings/branch_rules_settings_spec.rb

@@ -4,6 +4,8 @@
 
 RSpec.describe 'Projects > Settings > Repository > Branch rules settings', :js, feature_category: :source_code_management do
   include Spec::Support::Helpers::ModalHelpers
+  include ListboxHelpers
+
   let_it_be(:user) { create(:user) }
 
   let_it_be(:branch_rule) do
@@ -24,7 +26,7 @@
   context 'when not licensed' do
     before do
       stub_licensed_features(merge_request_approvers: false, external_status_checks: false,
-        multiple_approval_rules: false)
+        multiple_approval_rules: false, protected_refs_for_users: false)
     end
 
     context 'with custom rule' do
@@ -34,19 +36,48 @@
         wait_for_requests
       end
 
+      it 'does not render licensed feature additions' do
+        page.within(find_by_testid('allowed-to-push-content')) do
+          click_button 'Edit'
+        end
+
+        page.within('.gl-drawer') do
+          expect(page).not_to have_css '[data-testid="users-selector"]', text: 'Users'
+          expect(page).not_to have_css '[data-testid="groups-selector"]', text: 'Groups'
+        end
+      end
+
       it 'does not render licensed feature sections' do
         expect(page).not_to have_css 'h2', text: 'Merge request approvals'
         expect(page).not_to have_css 'h2', text: 'Status checks'
       end
     end
+
+    context 'with predefined rule' do
+      it 'does not render predefined rules' do
+        visit project_settings_repository_path(project)
+
+        wait_for_requests
+
+        click_button 'Add branch rule'
+
+        expect(page).not_to have_content 'All branches'
+        expect(page).not_to have_content 'All protected branches'
+      end
+    end
   end
 
   context 'when licensed' do
     before do
-      stub_licensed_features(merge_request_approvers: true, external_status_checks: true, multiple_approval_rules: true)
+      stub_licensed_features(merge_request_approvers: true, external_status_checks: true,
+        multiple_approval_rules: true, protected_refs_for_users: true)
     end
 
     context 'with custom rule' do
+      let!(:external_status_check) do
+        create(:external_status_check, project: project, protected_branches: [branch_rule])
+      end
+
       before do
         visit project_settings_repository_branch_rules_path(project, params: { branch: branch_rule.name })
 
@@ -63,58 +94,36 @@
         expect(page).to have_css 'h2', text: 'Status checks'
       end
 
-      it do
-        page.within(find_by_testid('allowed-to-merge-content')) do
+      it 'renders users and groups selectors for branch protection' do
+        page.within(find_by_testid('allowed-to-push-content')) do
           click_button 'Edit'
         end
 
         page.within('.gl-drawer') do
-          expect(page).to be_axe_clean.skipping :'link-in-text-block'
+          expect(page).to have_css '[data-testid="users-selector"]', text: 'Users'
+          expect(page).to have_css '[data-testid="groups-selector"]', text: 'Groups'
         end
       end
-    end
 
-    context 'with branch rule details for a predefined rule' do
-      before do
-        visit project_settings_repository_path(project)
-
-        wait_for_requests
-
-        click_button 'Add branch rule'
-        click_button 'All branches'
-
-        wait_for_requests
-      end
-
-      it 'creates a new rule' do
-        click_button 'Add approval rule'
-
-        fill_in 'rule-name-input', with: 'Test rule'
-
-        page.within(find_by_testid('users-selector')) do
-          find('.form-control').click
-          first('.gl-new-dropdown-item').click
+      it 'can edit branch protection' do
+        page.within(find_by_testid('allowed-to-push-content')) do
+          click_button 'Edit'
         end
 
-        click_button 'Save changes'
-
-        visit project_settings_repository_path(project)
+        page.within('.gl-drawer') do
+          check 'Administrators'
+          page.within(find_by_testid('users-selector')) do
+            find('.form-control').click
+            first('.gl-new-dropdown-item').click
+          end
 
-        page.within(find_by_testid('branch-rules-content')) do
-          expect(page).to have_content('All branches')
-          expect(page).to have_content('1 approval rule')
+          click_button 'Save changes'
         end
-      end
-    end
 
-    context 'with branch rules details for a custom rule' do
-      let!(:external_status_check) do
-        create(:external_status_check, project: project, protected_branches: [branch_rule])
-      end
-
-      before do
-        visit project_settings_repository_branch_rules_path(project, params: { branch: branch_rule.name })
         wait_for_requests
+
+        expect(page).to have_text 'Administrators'
+        expect_avatar(user)
       end
 
       it 'can create status check' do
@@ -175,6 +184,66 @@
           end
         end
       end
+
+      it 'passes axe automated accessibility testing' do
+        page.within(find_by_testid('allowed-to-merge-content')) do
+          click_button 'Edit'
+        end
+
+        page.within('.gl-drawer') do
+          expect(page).to be_axe_clean.skipping :'link-in-text-block'
+        end
+      end
+    end
+
+    context 'with branch rule details for a predefined rule' do
+      before do
+        visit project_settings_repository_path(project)
+
+        wait_for_requests
+
+        click_button 'Add branch rule'
+        click_button 'All branches'
+
+        wait_for_requests
+      end
+
+      it 'does not create a rule if a user leaves it empty' do
+        visit project_settings_repository_path(project)
+        expect(page).not_to have_css '[data-testid="branch-content"]', text: 'All branches'
+      end
+
+      it 'creates a new rule' do
+        click_button 'Add approval rule'
+
+        fill_in 'rule-name-input', with: 'Test rule'
+
+        page.within(find_by_testid('users-selector')) do
+          find('.form-control').click
+          first('.gl-new-dropdown-item').click
+        end
+
+        click_button 'Save changes'
+
+        visit project_settings_repository_path(project)
+
+        page.within(find_by_testid('branch-rules-content')) do
+          expect(page).to have_content('All branches')
+          expect(page).to have_content('1 approval rule')
+        end
+      end
     end
   end
+
+  def expect_avatar(users)
+    users = Array(users)
+
+    members = page.all('[data-testid="allowed-to-push-content"] img.gl-avatar').pluck('alt')
+
+    users.each do |user|
+      expect(members).to include(user.name)
+    end
+
+    expect(members.size).to eq(users.size)
+  end
 end

ee/spec/frontend/projects/settings/branch_rules/components/view/rule_drawer_spec.js

@@ -21,12 +21,18 @@ describe('Edit Rule Drawer', () => {
   const findDeployKeysSelector = () => wrapper.findByTestId('deploy-keys-selector');
   const findSaveButton = () => wrapper.findByText('Save changes');
 
-  const createComponent = (props = allowedToMergeDrawerProps) => {
+  const createComponent = (
+    props = allowedToMergeDrawerProps,
+    showEnterpriseAccessLevels = true,
+  ) => {
     wrapper = shallowMountExtended(RuleDrawer, {
       components: { ItemsSelector },
       propsData: {
         ...props,
       },
+      provide: {
+        showEnterpriseAccessLevels,
+      },
     });
   };
 
@@ -100,4 +106,16 @@ describe('Edit Rule Drawer', () => {
     await nextTick();
     expect(findSaveButton().attributes('disabled')).toBeUndefined();
   });
+
+  describe('when enterprise access levels are not enabled', () => {
+    beforeEach(() => createComponent(allowedToMergeDrawerProps, false));
+
+    it('does not render Item Selector with users', () => {
+      expect(findUsersSelector().exists()).toBe(false);
+    });
+
+    it('does not render Item Selector with groups', () => {
+      expect(findGroupsSelector().exists()).toBe(false);
+    });
+  });
 });

ee/spec/helpers/projects/settings/branch_rules_helper_spec.rb

@@ -14,7 +14,8 @@
       stub_licensed_features(
         external_status_checks: true,
         merge_request_approvers: true,
-        code_owner_approval_required: true
+        code_owner_approval_required: true,
+        protected_refs_for_users: true
       )
     end
 
@@ -30,6 +31,7 @@
         show_status_checks: 'true',
         show_approvers: 'true',
         show_code_owners: 'true',
+        show_enterprise_access_levels: 'true',
         allow_multi_rule: 'false',
         can_edit: 'false',
         project_id: project.id,
@@ -43,7 +45,8 @@
         stub_licensed_features(
           external_status_checks: false,
           merge_request_approvers: false,
-          code_owner_approval_required: false
+          code_owner_approval_required: false,
+          protected_refs_for_users: false
         )
       end
 
@@ -51,7 +54,8 @@
         expect(data).to include({
           show_status_checks: 'false',
           show_approvers: 'false',
-          show_code_owners: 'false'
+          show_code_owners: 'false',
+          show_enterprise_access_levels: 'false'
         })
       end
     end

gems/gem.gitlab-ci.yml

@@ -47,6 +47,7 @@ default:
   before_script:
     - cd $[[inputs.gem_path_prefix]]$[[inputs.gem_name]]
     - ruby -v                                   # Print out ruby version for debugging
+    - gem update --system
     - bundle_version=$(grep -A 1 "BUNDLED WITH" Gemfile.lock | tail -n 1 | sed -e 's/[[:space:]]//')
     - gem install bundler --version "$bundle_version" --no-document # Bundler is not installed with the image
     - bundle config                             # Show bundler configuration

gems/gitlab-backup-cli/Gemfile.lock

@@ -186,4 +186,4 @@ DEPENDENCIES
   rubocop-rails (<= 2.20)
 
 BUNDLED WITH
-   2.5.7
+   2.5.18

spec/features/projects/settings/branch_rules_settings_spec.rb

@@ -49,25 +49,6 @@
     end
   end
 
-  context 'Branch rule details for a predefined rule', :js do
-    let(:role) { :maintainer }
-
-    before do
-      visit_branch_rules_settings
-      wait_for_requests
-
-      click_button 'Add branch rule'
-      click_button 'All branches'
-
-      wait_for_requests
-    end
-
-    it 'does not create a rule if a user leaves it empty' do
-      visit_branch_rules_settings
-      expect(page).not_to have_css '[data-testid="branch-content"]', text: 'All branches'
-    end
-  end
-
   context 'Branch rule details for custom rule', :js do
     let(:role) { :maintainer }
 

spec/frontend/projects/settings/repository/branch_rules/app_spec.js

@@ -53,6 +53,7 @@ describe('Branch rules app', () => {
     glFeatures = { editBranchRules: true },
     queryHandler = branchRulesQuerySuccessHandler,
     mutationHandler = addRuleMutationSuccessHandler,
+    provided = appProvideMock,
   } = {}) => {
     fakeApollo = createMockApollo([
       [branchRulesQuery, queryHandler],
@@ -63,7 +64,7 @@ describe('Branch rules app', () => {
     wrapper = mountExtended(BranchRules, {
       apolloProvider: fakeApollo,
       provide: {
-        ...appProvideMock,
+        ...provided,
         glFeatures,
       },
       stubs: {
@@ -120,28 +121,12 @@ describe('Branch rules app', () => {
       expect(findAddBranchRuleDropdown().props('toggleText')).toBe('Add branch rule');
     });
 
-    it('renders a dropdown containing predefined branch rules with actions', () => {
+    it('renders a dropdown containing custom rules with actions', () => {
       expect(findAddBranchRuleDropdown().props('items')).toEqual([
         { action: expect.any(Function), text: 'Branch name or pattern' },
-        { action: expect.any(Function), text: 'All branches' },
-        { action: expect.any(Function), text: 'All protected branches' },
       ]);
     });
 
-    it('does not render predefined branch rules when they are already set', async () => {
-      const { nodes } = predefinedBranchRulesMockResponse.data.project.branchRules;
-
-      await createComponent({
-        queryHandler: jest.fn().mockResolvedValue(predefinedBranchRulesMockResponse),
-      });
-      await findAddBranchRuleDropdown().vm.$emit('shown');
-      await nextTick();
-
-      expect(findAddBranchRuleDropdown().props('items').length).toEqual(
-        addBranchRulesItems.length - nodes.length,
-      );
-    });
-
     it('renders a modal with correct props/attributes', () => {
       expect(findModal().props()).toMatchObject({
         title: I18N.createBranchRule,
@@ -193,6 +178,48 @@ describe('Branch rules app', () => {
         label: 'branch_rule_details',
       });
     });
+
+    describe('when status check and merge request approvals features are available', () => {
+      describe.each`
+        showStatusChecks | showApprovers
+        ${true}          | ${false}
+        ${false}         | ${true}
+        ${true}          | ${true}
+      `(
+        'when showStatusChecks is $showStatusChecks and showApprovers is $showApprovers',
+        ({ showStatusChecks, showApprovers }) => {
+          it(`renders a dropdown containing predefined branch rules with actions`, () => {
+            createComponent({
+              provided: {
+                ...appProvideMock,
+                showStatusChecks,
+                showApprovers,
+              },
+            });
+            expect(findAddBranchRuleDropdown().props('items')).toEqual([
+              { action: expect.any(Function), text: 'Branch name or pattern' },
+              { action: expect.any(Function), text: 'All branches' },
+              { action: expect.any(Function), text: 'All protected branches' },
+            ]);
+          });
+        },
+      );
+
+      it('does not render predefined branch rules when they are already set', async () => {
+        const { nodes } = predefinedBranchRulesMockResponse.data.project.branchRules;
+
+        await createComponent({
+          queryHandler: jest.fn().mockResolvedValue(predefinedBranchRulesMockResponse),
+          provided: { ...appProvideMock, showStatusChecks: true, showApprovers: true },
+        });
+        await findAddBranchRuleDropdown().vm.$emit('shown');
+        await nextTick();
+
+        expect(findAddBranchRuleDropdown().props('items').length).toEqual(
+          addBranchRulesItems.length - nodes.length,
+        );
+      });
+    });
   });
 
   describe('Add branch rule when editBranchRules FF disabled', () => {