ee/spec/lib/ee/gitlab/usage_data_spec.rb

@@ -29,6 +29,8 @@
       create(:ci_build, name: 'sast', pipeline: pipeline)
       create(:ci_build, name: 'secret_detection', pipeline: pipeline)
       create(:ci_build, name: 'coverage_fuzzing', pipeline: pipeline)
+      create(:ci_build, name: 'apifuzzer_fuzz', pipeline: pipeline)
+      create(:ci_build, name: 'apifuzzer_fuzz_dnd', pipeline: pipeline)
       create(:ci_pipeline, source: :ondemand_dast_scan, project: projects[0])
 
       create(:prometheus_alert, project: projects[0])
@@ -145,6 +147,8 @@
       expect(count_data[:sast_jobs]).to eq(1)
       expect(count_data[:secret_detection_jobs]).to eq(1)
       expect(count_data[:coverage_fuzzing_jobs]).to eq(1)
+      expect(count_data[:api_fuzzing_jobs]).to eq(1)
+      expect(count_data[:api_fuzzing_dnd_jobs]).to eq(1)
       expect(count_data[:dast_on_demand_pipelines]).to eq(1)
     end
 
@@ -528,6 +532,8 @@ def ldap_server_config
 
     before do
       for_defined_days_back do
+        create(:ci_build, name: 'apifuzzer_fuzz', user: user)
+        create(:ci_build, name: 'apifuzzer_fuzz_dnd', user: user)
         create(:ci_build, name: 'container_scanning', user: user)
         create(:ci_build, name: 'coverage_fuzzing', user: user)
         create(:ci_build, name: 'dast', user: user)
@@ -542,6 +548,8 @@ def ldap_server_config
       expect(described_class.usage_activity_by_stage_secure(described_class.last_28_days_time_period)).to eq(
         user_preferences_group_overview_security_dashboard: 3,
         user_container_scanning_jobs: 1,
+        user_api_fuzzing_jobs: 1,
+        user_api_fuzzing_dnd_jobs: 1,
         user_coverage_fuzzing_jobs: 1,
         user_dast_jobs: 1,
         user_dependency_scanning_jobs: 1,
@@ -601,7 +609,10 @@ def ldap_server_config
 
       expect(described_class.usage_activity_by_stage_secure(described_class.last_28_days_time_period)).to include(
         user_preferences_group_overview_security_dashboard: 3,
+        user_api_fuzzing_jobs: 1,
+        user_api_fuzzing_dnd_jobs: 1,
         user_container_scanning_jobs: 1,
+        user_coverage_fuzzing_jobs: 1,
         user_dast_jobs: 1,
         user_dependency_scanning_jobs: 1,
         user_license_management_jobs: 1,
@@ -634,6 +645,8 @@ def ldap_server_config
 
       expect(described_class.usage_activity_by_stage_secure(described_class.last_28_days_time_period)).to eq(
         user_preferences_group_overview_security_dashboard: 3,
+        user_api_fuzzing_jobs: 1,
+        user_api_fuzzing_dnd_jobs: 1,
         user_container_scanning_jobs: 1,
         user_coverage_fuzzing_jobs: 1,
         user_dast_jobs: 3,
@@ -666,6 +679,8 @@ def ldap_server_config
 
       expect(described_class.usage_activity_by_stage_secure(described_class.last_28_days_time_period)).to eq(
         user_preferences_group_overview_security_dashboard: 3,
+        user_api_fuzzing_jobs: 1,
+        user_api_fuzzing_dnd_jobs: 1,
         user_container_scanning_jobs: 1,
         user_coverage_fuzzing_jobs: 1,
         user_dast_jobs: 1,
@@ -698,6 +713,8 @@ def ldap_server_config
 
       expect(described_class.usage_activity_by_stage_secure(described_class.last_28_days_time_period)).to eq(
         user_preferences_group_overview_security_dashboard: -1,
+        user_api_fuzzing_jobs: -1,
+        user_api_fuzzing_dnd_jobs: -1,
         user_container_scanning_jobs: -1,
         user_coverage_fuzzing_jobs: -1,
         user_dast_jobs: -1,

ee/spec/models/ee/terraform/state_version_spec.rb

@@ -17,7 +17,7 @@
     end
 
     it 'excludes states without local storage' do
-      stub_terraform_state_version_object_storage
+      stub_terraform_state_object_storage
 
       create_list(:terraform_state_version, 5)
 
@@ -53,7 +53,7 @@
 
       before do
         stub_current_geo_node(secondary)
-        stub_terraform_state_version_object_storage if terraform_object_storage_enabled
+        stub_terraform_state_object_storage if terraform_object_storage_enabled
 
         create_list(:terraform_state_version, 5, terraform_state: create(:terraform_state, project: project))
         create_list(:terraform_state_version, 5, terraform_state: create(:terraform_state, project: create(:project)))

lib/api/users.rb

@@ -534,6 +534,24 @@ def reorder_users(users)
 
         user.activate
       end
+
+      desc 'Approve a pending user. Available only for admins.'
+      params do
+        requires :id, type: Integer, desc: 'The ID of the user'
+      end
+      post ':id/approve', feature_category: :authentication_and_authorization do
+        user = User.find_by(id: params[:id])
+        not_found!('User') unless can?(current_user, :read_user, user)
+
+        result = ::Users::ApproveService.new(current_user).execute(user)
+
+        if result[:success]
+          result
+        else
+          render_api_error!(result[:message], result[:http_status])
+        end
+      end
+
       # rubocop: enable CodeReuse/ActiveRecord
       desc 'Deactivate an active user. Available only for admins.'
       params do

lib/gitlab/ci/build/rules/rule/clause/changes.rb

@@ -11,7 +11,7 @@ def initialize(globs)
         def satisfied_by?(pipeline, context)
           return true if pipeline.modified_paths.nil?
 
-          expanded_globs = expand_globs(pipeline, context)
+          expanded_globs = expand_globs(context)
           pipeline.modified_paths.any? do |path|
             expanded_globs.any? do |glob|
               File.fnmatch?(glob, path, File::FNM_PATHNAME | File::FNM_DOTMATCH | File::FNM_EXTGLOB)
@@ -19,8 +19,7 @@ def satisfied_by?(pipeline, context)
           end
         end
 
-        def expand_globs(pipeline, context)
-          return @globs unless ::Feature.enabled?(:ci_variable_expansion_in_rules_changes, pipeline.project, default_enabled: true)
+        def expand_globs(context)
           return @globs unless context
 
           @globs.map do |glob|

spec/factories/terraform/state.rb

@@ -6,11 +6,6 @@
 
     sequence(:name) { |n| "state-#{n}" }
 
-    trait :with_file do
-      versioning_enabled { false }
-      file { fixture_file_upload('spec/fixtures/terraform/terraform.tfstate', 'application/json') }
-    end
-
     trait :locked do
       sequence(:lock_xid) { |n| "lock-#{n}" }
       locked_at { Time.current }
@@ -22,8 +17,5 @@
         create(:terraform_state_version, terraform_state: state)
       end
     end
-
-    # Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/235108
-    factory :legacy_terraform_state, parent: :terraform_state, traits: [:with_file]
   end
 end

spec/factories/users.rb

@@ -35,6 +35,10 @@
       user_type { :alert_bot }
     end
 
+    trait :deactivated do
+      after(:build) { |user, _| user.deactivate! }
+    end
+
     trait :project_bot do
       user_type { :project_bot }
     end

spec/graphql/types/user_type_spec.rb

@@ -21,6 +21,7 @@
       todos
       state
       status
+      location
       authoredMergeRequests
       assignedMergeRequests
       groupMemberships

spec/models/terraform/state_spec.rb

@@ -3,21 +3,13 @@
 require 'spec_helper'
 
 RSpec.describe Terraform::State do
-  subject { create(:terraform_state, :with_file) }
-
-  let(:terraform_state_file) { fixture_file('terraform/terraform.tfstate') }
-
-  it { is_expected.to be_a FileStoreMounter }
+  subject { create(:terraform_state, :with_version) }
 
   it { is_expected.to belong_to(:project) }
   it { is_expected.to belong_to(:locked_by_user).class_name('User') }
 
   it { is_expected.to validate_presence_of(:project_id) }
 
-  before do
-    stub_terraform_state_object_storage
-  end
-
   describe 'scopes' do
     describe '.ordered_by_name' do
       let_it_be(:project) { create(:project) }
@@ -35,64 +27,18 @@
     end
   end
 
-  describe '#file' do
-    context 'when a file exists' do
-      it 'does not use the default file' do
-        expect(subject.file.read).to eq(terraform_state_file)
-      end
-    end
-  end
-
-  describe '#file_store' do
-    context 'when a value is set' do
-      it 'returns the value' do
-        [ObjectStorage::Store::LOCAL, ObjectStorage::Store::REMOTE].each do |store|
-          expect(build(:terraform_state, file_store: store).file_store).to eq(store)
-        end
-      end
-    end
-  end
-
-  describe '#update_file_store' do
-    context 'when file is stored in object storage' do
-      it_behaves_like 'mounted file in object store'
-    end
-
-    context 'when file is stored locally' do
-      before do
-        stub_terraform_state_object_storage(enabled: false)
-      end
-
-      it_behaves_like 'mounted file in local store'
-    end
-  end
-
   describe '#latest_file' do
-    subject { terraform_state.latest_file }
-
-    context 'versioning is enabled' do
-      let(:terraform_state) { create(:terraform_state, :with_version) }
-      let(:latest_version) { terraform_state.latest_version }
-
-      it { is_expected.to eq latest_version.file }
-
-      context 'but no version exists yet' do
-        let(:terraform_state) { create(:terraform_state) }
+    let(:terraform_state) { create(:terraform_state, :with_version) }
+    let(:latest_version) { terraform_state.latest_version }
 
-        it { is_expected.to be_nil }
-      end
-    end
-
-    context 'versioning is disabled' do
-      let(:terraform_state) { create(:terraform_state, :with_file) }
+    subject { terraform_state.latest_file }
 
-      it { is_expected.to eq terraform_state.file }
+    it { is_expected.to eq latest_version.file }
 
-      context 'and a version exists (migration to versioned in progress)' do
-        let!(:migrated_version) { create(:terraform_state_version, terraform_state: terraform_state) }
+    context 'but no version exists yet' do
+      let(:terraform_state) { create(:terraform_state) }
 
-        it { is_expected.to eq terraform_state.latest_version.file }
-      end
+      it { is_expected.to be_nil }
     end
   end
 
@@ -115,39 +61,30 @@
       end
     end
 
-    context 'versioning is disabled' do
-      let(:terraform_state) { create(:terraform_state, :with_file) }
-
-      it 'modifies the existing state record' do
-        expect { subject }.not_to change { Terraform::StateVersion.count }
+    context 'versioning is disabled (migration to versioned in progress)' do
+      let(:terraform_state) { create(:terraform_state, versioning_enabled: false) }
+      let!(:migrated_version) { create(:terraform_state_version, terraform_state: terraform_state, version: 0) }
 
-        expect(terraform_state.latest_file.read).to eq(data)
-      end
-
-      context 'and a version exists (migration to versioned in progress)' do
-        let!(:migrated_version) { create(:terraform_state_version, terraform_state: terraform_state, version: 0) }
+      it 'creates a new version, corrects the migrated version number, and marks the state as versioned' do
+        expect { subject }.to change { Terraform::StateVersion.count }
 
-        it 'creates a new version, corrects the migrated version number, and marks the state as versioned' do
-          expect { subject }.to change { Terraform::StateVersion.count }
+        expect(migrated_version.reload.version).to eq(1)
+        expect(migrated_version.file.read).to eq(fixture_file('terraform/terraform.tfstate'))
 
-          expect(migrated_version.reload.version).to eq(1)
-          expect(migrated_version.file.read).to eq(terraform_state_file)
+        expect(terraform_state.reload.latest_version.version).to eq(version)
+        expect(terraform_state.latest_version.file.read).to eq(data)
+        expect(terraform_state).to be_versioning_enabled
+      end
 
-          expect(terraform_state.reload.latest_version.version).to eq(version)
-          expect(terraform_state.latest_version.file.read).to eq(data)
-          expect(terraform_state).to be_versioning_enabled
+      context 'the current version cannot be determined' do
+        before do
+          migrated_version.update!(file: CarrierWaveStringFile.new('invalid-json'))
         end
 
-        context 'the current version cannot be determined' do
-          before do
-            migrated_version.update!(file: CarrierWaveStringFile.new('invalid-json'))
-          end
-
-          it 'uses version - 1 to correct the migrated version number' do
-            expect { subject }.to change { Terraform::StateVersion.count }
+        it 'uses version - 1 to correct the migrated version number' do
+          expect { subject }.to change { Terraform::StateVersion.count }
 
-            expect(migrated_version.reload.version).to eq(2)
-          end
+          expect(migrated_version.reload.version).to eq(2)
         end
       end
     end

spec/requests/api/users_spec.rb

@@ -2510,6 +2510,98 @@ def update_password(user, admin, password = User.random_password)
     end
   end
 
+  context 'approve pending user' do
+    shared_examples '404' do
+      it 'returns 404' do
+        expect(response).to have_gitlab_http_status(:not_found)
+        expect(json_response['message']).to eq('404 User Not Found')
+      end
+    end
+
+    describe 'POST /users/:id/approve' do
+      subject(:approve) { post api("/users/#{user_id}/approve", api_user) }
+
+      let_it_be(:pending_user) { create(:user, :blocked_pending_approval) }
+      let_it_be(:deactivated_user) { create(:user, :deactivated) }
+      let_it_be(:blocked_user) { create(:user, :blocked) }
+
+      context 'performed by a non-admin user' do
+        let(:api_user) { user }
+        let(:user_id) { pending_user.id }
+
+        it 'is not authorized to perform the action' do
+          expect { approve }.not_to change { pending_user.reload.state }
+          expect(response).to have_gitlab_http_status(:forbidden)
+          expect(json_response['message']).to eq('You are not allowed to approve a user')
+        end
+      end
+
+      context 'performed by an admin user' do
+        let(:api_user) { admin }
+
+        context 'for a deactivated user' do
+          let(:user_id) { deactivated_user.id }
+
+          it 'does not approve a deactivated user' do
+            expect { approve }.not_to change { deactivated_user.reload.state }
+            expect(response).to have_gitlab_http_status(:conflict)
+            expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval')
+          end
+        end
+
+        context 'for an pending approval user' do
+          let(:user_id) { pending_user.id }
+
+          it 'returns 201' do
+            expect { approve }.to change { pending_user.reload.state }.to('active')
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response['message']).to eq('Success')
+          end
+        end
+
+        context 'for an active user' do
+          let(:user_id) { user.id }
+
+          it 'returns 201' do
+            expect { approve }.not_to change { user.reload.state }
+            expect(response).to have_gitlab_http_status(:conflict)
+            expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval')
+          end
+        end
+
+        context 'for a blocked user' do
+          let(:user_id) { blocked_user.id }
+
+          it 'returns 403' do
+            expect { approve }.not_to change { blocked_user.reload.state }
+            expect(response).to have_gitlab_http_status(:conflict)
+            expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval')
+          end
+        end
+
+        context 'for a ldap blocked user' do
+          let(:user_id) { ldap_blocked_user.id }
+
+          it 'returns 403' do
+            expect { approve }.not_to change { ldap_blocked_user.reload.state }
+            expect(response).to have_gitlab_http_status(:conflict)
+            expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval')
+          end
+        end
+
+        context 'for a user that does not exist' do
+          let(:user_id) { non_existing_record_id }
+
+          before do
+            approve
+          end
+
+          it_behaves_like '404'
+        end
+      end
+    end
+  end
+
   describe 'POST /users/:id/block' do
     let(:blocked_user) { create(:user, state: 'blocked') }
 

spec/support/helpers/stub_object_storage.rb

@@ -93,13 +93,6 @@ def stub_uploads_object_storage(uploader = described_class, **params)
   end
 
   def stub_terraform_state_object_storage(**params)
-    stub_object_storage_uploader(config: Gitlab.config.terraform_state.object_store,
-                                 uploader: Terraform::VersionedStateUploader,
-                                 remote_directory: 'terraform',
-                                 **params)
-  end
-
-  def stub_terraform_state_version_object_storage(**params)
     stub_object_storage_uploader(config: Gitlab.config.terraform_state.object_store,
                                  uploader: Terraform::StateUploader,
                                  remote_directory: 'terraform',

spec/uploaders/terraform/state_uploader_spec.rb

@@ -3,23 +3,45 @@
 require 'spec_helper'
 
 RSpec.describe Terraform::StateUploader do
-  subject { terraform_state.file }
+  subject { state_version.file }
 
-  let(:terraform_state) { create(:terraform_state, :with_file) }
+  let(:state_version) { create(:terraform_state_version) }
 
   before do
     stub_terraform_state_object_storage
   end
 
   describe '#filename' do
-    it 'contains the UUID of the terraform state record' do
-      expect(subject.filename).to include(terraform_state.uuid)
+    it 'contains the version of the terraform state record' do
+      expect(subject.filename).to eq("#{state_version.version}.tfstate")
+    end
+
+    context 'legacy state with versioning disabled' do
+      let(:state) { create(:terraform_state, versioning_enabled: false) }
+      let(:state_version) { create(:terraform_state_version, terraform_state: state) }
+
+      it 'contains the UUID of the terraform state record' do
+        expect(subject.filename).to eq("#{state_version.uuid}.tfstate")
+      end
     end
   end
 
   describe '#store_dir' do
-    it 'contains the ID of the project' do
-      expect(subject.store_dir).to include(terraform_state.project_id.to_s)
+    it 'hashes the project ID and UUID' do
+      expect(Gitlab::HashedPath).to receive(:new)
+        .with(state_version.uuid, root_hash: state_version.project_id)
+        .and_return(:store_dir)
+
+      expect(subject.store_dir).to eq(:store_dir)
+    end
+
+    context 'legacy state with versioning disabled' do
+      let(:state) { create(:terraform_state, versioning_enabled: false) }
+      let(:state_version) { create(:terraform_state_version, terraform_state: state) }
+
+      it 'contains the ID of the project' do
+        expect(subject.store_dir).to include(state_version.project_id.to_s)
+      end
     end
   end
 
@@ -27,7 +49,7 @@
     it 'creates a digest with a secret key and the project id' do
       expect(OpenSSL::HMAC)
         .to receive(:digest)
-        .with('SHA256', Gitlab::Application.secrets.db_key_base, terraform_state.project_id.to_s)
+        .with('SHA256', Gitlab::Application.secrets.db_key_base, state_version.project_id.to_s)
         .and_return('digest')
 
       expect(subject.key).to eq('digest')

spec/uploaders/terraform/versioned_state_uploader_spec.rb

-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Terraform::VersionedStateUploader do
-  subject { model.file }
-
-  let(:model) { create(:terraform_state_version, :with_file) }
-
-  before do
-    stub_terraform_state_object_storage
-  end
-
-  describe '#filename' do
-    it 'contains the version of the terraform state record' do
-      expect(subject.filename).to eq("#{model.version}.tfstate")
-    end
-
-    context 'legacy state with versioning disabled' do
-      let(:state) { create(:legacy_terraform_state) }
-      let(:model) { create(:terraform_state_version, terraform_state: state) }
-
-      it 'contains the UUID of the terraform state record' do
-        expect(subject.filename).to eq("#{model.uuid}.tfstate")
-      end
-    end
-  end
-
-  describe '#store_dir' do
-    it 'hashes the project ID and UUID' do
-      expect(Gitlab::HashedPath).to receive(:new)
-        .with(model.uuid, root_hash: model.project_id)
-        .and_return(:store_dir)
-
-      expect(subject.store_dir).to eq(:store_dir)
-    end
-
-    context 'legacy state with versioning disabled' do
-      let(:state) { create(:legacy_terraform_state) }
-      let(:model) { create(:terraform_state_version, terraform_state: state) }
-
-      it 'contains the ID of the project' do
-        expect(subject.store_dir).to include(model.project_id.to_s)
-      end
-    end
-  end
-end