CSV download for Merge Commits

What does this MR do?

This MR adds the backend changes for group owners and admins to download a CSV copy of Merge Commits for a Group.

The download option will be present in the Compliance dashboard. FE MR: !38513 (merged)

It restricts the download file up to 15MB.

Mentions #213364 (closed)

Screenshots

Example CSV file: 119-merge-commits-1596485203.csv

Database changes

Query using MergeRequestFinder

Query

explain SELECT
    "merge_requests".*
FROM
    "merge_requests"
    INNER JOIN "projects" ON "projects"."id" = "merge_requests"."target_project_id"
    LEFT JOIN project_features ON projects.id = project_features.project_id
WHERE
    "projects"."namespace_id" = 9970
    AND (EXISTS (
            SELECT
                1
            FROM
                "project_authorizations"
            WHERE
                "project_authorizations"."user_id" = 4014344
                AND (project_authorizations.project_id = projects.id))
            OR projects.visibility_level IN (0, 10, 20))
    AND ("project_features"."merge_requests_access_level" > 0
        OR "project_features"."merge_requests_access_level" IS NULL)
    AND ("merge_requests"."state_id" IN (3))
ORDER BY
    "merge_requests"."id" ASC
LIMIT 1000

Plan execution: https://explain.depesz.com/s/GS3T

Execution Time:

Time: 4.693 s
  - planning: 2.370 ms
  - execution: 4.690 s
    - I/O read: 4.319 s
    - I/O write: 0.000 ms

Shared buffers:
  - hits: 6645 (~51.90 MiB) from the buffer pool
  - reads: 71478 (~558.40 MiB) from the OS file cache, including disk I/O
  - dirtied: 1492 (~11.70 MiB)
  - writes: 0

#database-lab: https://gitlab.slack.com/archives/CLJMDRD8C/p1597200797223700

Migration

== 20200810160031 AddIndexMergedStateOnMergeRequests: migrating ===============
-- transaction_open?()
   -> 0.0000s
-- index_exists?(:merge_requests, [:target_project_id, :iid, :state_id], {:where=>"state_id = 3", :name=>"index_merged_state_on_merge_requests", :algorithm=>:concurrently})
   -> 0.0099s
-- add_index(:merge_requests, [:target_project_id, :iid, :state_id], {:where=>"state_id = 3", :name=>"index_merged_state_on_merge_requests", :algorithm=>:concurrently})
   -> 0.0062s
== 20200810160031 AddIndexMergedStateOnMergeRequests: migrated (0.0166s) ======

Rollback

== 20200810160031 AddIndexMergedStateOnMergeRequests: reverting ===============
-- transaction_open?()
   -> 0.0000s
-- indexes(:merge_requests)
   -> 0.0177s
-- remove_index(:merge_requests, {:algorithm=>:concurrently, :name=>"index_merged_state_on_merge_requests"})
   -> 0.0064s
== 20200810160031 AddIndexMergedStateOnMergeRequests: reverted (0.0248s) ======

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team

ee/app/controllers/groups/security/merge_commits_report_controller.rb

+# frozen_string_literal: true
+class Groups::Security::MergeCommitsReportController < Groups::ApplicationController
+  include Groups::SecurityFeaturesHelper
+
+  before_action :authorize_compliance_dashboard!
+
+  def index
+    csv_data = MergeCommits::ExportCsvService.new(current_user, group.id).csv_data
+
+    respond_to do |format|
+      format.csv do
+        send_data(
+          csv_data,
+          type: 'text/csv; charset=utf-8; header=present',
+          filename: merge_commits_csv_filename
+        )
+      end
+    end
+  end
+
+  private
+
+  def authorize_compliance_dashboard!
+    render_404 unless group_level_compliance_dashboard_available?(group)
+  end
+
+  def merge_commits_csv_filename
+    "#{group.id}-merge-commits-#{Time.current.to_i}.csv"
+  end
+end