From cc99de39a41acafdabab81d4ec2d8740ad8faa4a Mon Sep 17 00:00:00 2001
From: Alishan Ladhani <aladhani@gitlab.com>
Date: Tue, 27 Sep 2022 16:03:49 -0400
Subject: [PATCH] Enable Releases feature toggle

Changelog: added
---
 .../permissions/components/settings_panel.vue | 26 +++++++-------
 app/controllers/projects_controller.rb        |  4 +--
 app/policies/project_policy.rb                |  2 +-
 doc/api/projects.md                           |  3 ++
 doc/user/project/settings/index.md            |  3 +-
 lib/api/entities/project.rb                   |  1 +
 lib/api/helpers/projects_helpers.rb           |  2 ++
 .../projects/menus/deployments_menu_spec.rb   | 34 ++++++++++---------
 spec/requests/api/project_attributes.yml      |  1 -
 spec/requests/api/projects_spec.rb            | 24 ++++++++++++-
 10 files changed, 65 insertions(+), 35 deletions(-)

diff --git a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
index 040860c8c917ef..3e5c02bbf19e63 100644
--- a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
+++ b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
@@ -981,20 +981,20 @@ export default {
             name="project[project_feature_attributes][feature_flags_access_level]"
           />
         </project-setting-row>
-        <project-setting-row
-          ref="releases-settings"
-          :label="$options.i18n.releasesLabel"
-          :help-text="$options.i18n.releasesHelpText"
-          :help-path="releasesHelpPath"
-        >
-          <project-feature-setting
-            v-model="releasesAccessLevel"
-            :label="$options.i18n.releasesLabel"
-            :options="featureAccessLevelOptions"
-            name="project[project_feature_attributes][releases_access_level]"
-          />
-        </project-setting-row>
       </template>
+      <project-setting-row
+        ref="releases-settings"
+        :label="$options.i18n.releasesLabel"
+        :help-text="$options.i18n.releasesHelpText"
+        :help-path="releasesHelpPath"
+      >
+        <project-feature-setting
+          v-model="releasesAccessLevel"
+          :label="$options.i18n.releasesLabel"
+          :options="featureAccessLevelOptions"
+          name="project[project_feature_attributes][releases_access_level]"
+        />
+      </project-setting-row>
     </div>
     <project-setting-row v-if="canDisableEmails" ref="email-settings" class="mb-3">
       <label class="js-emails-disabled">
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 5ceedbc1e01737..aebd3248241a75 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -435,14 +435,14 @@ def project_feature_attributes
       analytics_access_level
       security_and_compliance_access_level
       container_registry_access_level
+      releases_access_level
     ] + operations_feature_attributes
   end
 
   def operations_feature_attributes
     if Feature.enabled?(:split_operations_visibility_permissions, project)
       %i[
-        environments_access_level feature_flags_access_level releases_access_level
-        monitor_access_level
+        environments_access_level feature_flags_access_level monitor_access_level
       ]
     else
       %i[operations_access_level]
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index fb162d039557a1..83a9e3583a8a16 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -399,7 +399,7 @@ class ProjectPolicy < BasePolicy
     prevent(:admin_feature_flags_client)
   end
 
-  rule { split_operations_visibility_permissions & releases_disabled }.policy do
+  rule { releases_disabled }.policy do
     prevent(*create_read_update_admin_destroy(:release))
   end
 
diff --git a/doc/api/projects.md b/doc/api/projects.md
index f236f987e798fd..6bba45418eba5f 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -1229,6 +1229,7 @@ curl --request POST --header "PRIVATE-TOKEN: <your-token>" \
 | `pages_access_level`                                        | string  | **{dotted-circle}** No | One of `disabled`, `private`, `enabled`, or `public`. |
 | `printing_merge_request_link_enabled`                       | boolean | **{dotted-circle}** No | Show link to create/view merge request when pushing from the command line. |
 | `public_builds`                                             | boolean | **{dotted-circle}** No | If `true`, jobs can be viewed by non-project members. |
+| `releases_access_level`                                     | string  | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `remove_source_branch_after_merge`                          | boolean | **{dotted-circle}** No | Enable `Delete source branch` option by default for all new merge requests. |
 | `repository_access_level`                                   | string  | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `repository_storage`                                        | string  | **{dotted-circle}** No | Which storage shard the repository is on. _(administrator only)_ |
@@ -1307,6 +1308,7 @@ POST /projects/user/:user_id
 | `path`                                                      | string  | **{dotted-circle}** No | Custom repository name for new project. By default generated based on name. |
 | `printing_merge_request_link_enabled`                       | boolean | **{dotted-circle}** No | Show link to create/view merge request when pushing from the command line. |
 | `public_builds`                                             | boolean | **{dotted-circle}** No | If `true`, jobs can be viewed by non-project-members. |
+| `releases_access_level`                                     | string  | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `remove_source_branch_after_merge`                          | boolean | **{dotted-circle}** No | Enable `Delete source branch` option by default for all new merge requests. |
 | `repository_access_level`                                   | string  | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `repository_storage`                                        | string  | **{dotted-circle}** No | Which storage shard the repository is on. _(administrators only)_ |
@@ -1408,6 +1410,7 @@ Supported attributes:
 | `path`                                                      | string         | **{dotted-circle}** No | Custom repository name for the project. By default generated based on name. |
 | `printing_merge_request_link_enabled`                       | boolean        | **{dotted-circle}** No | Show link to create/view merge request when pushing from the command line. |
 | `public_builds`                                             | boolean        | **{dotted-circle}** No | If `true`, jobs can be viewed by non-project members. |
+| `releases_access_level`                                     | string         | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `remove_source_branch_after_merge`                          | boolean        | **{dotted-circle}** No | Enable `Delete source branch` option by default for all new merge requests. |
 | `repository_access_level`                                   | string         | **{dotted-circle}** No | One of `disabled`, `private`, or `enabled`. |
 | `repository_storage`                                        | string         | **{dotted-circle}** No | Which storage shard the repository is on. _(administrators only)_ |
diff --git a/doc/user/project/settings/index.md b/doc/user/project/settings/index.md
index d7f6ef8539fcea..58d843aab45822 100644
--- a/doc/user/project/settings/index.md
+++ b/doc/user/project/settings/index.md
@@ -258,7 +258,8 @@ Use the toggles to enable or disable features in the project.
 | **Snippets**                     | ✓                         | Enables [sharing of code and text](../../snippets.md). |
 | **Pages**                        | ✓                         | Allows you to [publish static websites](../pages/index.md). |
 | **Operations**                   | ✓                         | Control access to Operations-related features, including [Operations Dashboard](../../../operations/index.md), [Environments and Deployments](../../../ci/environments/index.md), [Feature Flags](../../../operations/feature_flags.md). |
-| **Metrics Dashboard**            | ✓                         | Control access to [metrics dashboard](../integrations/prometheus.md). |
+| **Metrics Dashboard**            | ✓                         | Control access to [metrics dashboard](../integrations/prometheus.md).                                                                                                                                                                    |
+| **Releases**                     | ✓                         | Control access to [Releases](../releases/index.md).                                                                                                                                                                                      |
 
 When you disable a feature, the following additional features are also disabled:
 
diff --git a/lib/api/entities/project.rb b/lib/api/entities/project.rb
index 1739bdd639ed54..b3907397fbb9fc 100644
--- a/lib/api/entities/project.rb
+++ b/lib/api/entities/project.rb
@@ -80,6 +80,7 @@ class Project < BasicProjectDetails
       expose(:analytics_access_level) { |project, options| project_feature_string_access_level(project, :analytics) }
       expose(:container_registry_access_level) { |project, options| project_feature_string_access_level(project, :container_registry) }
       expose(:security_and_compliance_access_level) { |project, options| project_feature_string_access_level(project, :security_and_compliance) }
+      expose(:releases_access_level) { |project, options| project_feature_string_access_level(project, :releases) }
 
       expose :emails_disabled
       expose :shared_runners_enabled
diff --git a/lib/api/helpers/projects_helpers.rb b/lib/api/helpers/projects_helpers.rb
index 7ca3f55b5a2c7e..716db9a87b0cba 100644
--- a/lib/api/helpers/projects_helpers.rb
+++ b/lib/api/helpers/projects_helpers.rb
@@ -36,6 +36,7 @@ module ProjectsHelpers
         optional :analytics_access_level, type: String, values: %w(disabled private enabled), desc: 'Analytics access level. One of `disabled`, `private` or `enabled`'
         optional :container_registry_access_level, type: String, values: %w(disabled private enabled), desc: 'Controls visibility of the container registry. One of `disabled`, `private` or `enabled`. `private` will make the container registry accessible only to project members (reporter role and above). `enabled` will make the container registry accessible to everyone who has access to the project. `disabled` will disable the container registry'
         optional :security_and_compliance_access_level, type: String, values: %w(disabled private enabled), desc: 'Security and compliance access level. One of `disabled`, `private` or `enabled`'
+        optional :releases_access_level, type: String, values: %w(disabled private enabled), desc: 'Releases access level. One of `disabled`, `private` or `enabled`'
 
         optional :emails_disabled, type: Boolean, desc: 'Disable email notifications'
         optional :show_default_award_emojis, type: Boolean, desc: 'Show default award emojis'
@@ -179,6 +180,7 @@ def self.update_params_at_least_one_of
           :keep_latest_artifact,
           :mr_default_target_self,
           :enforce_auth_checks_on_uploads,
+          :releases_access_level,
 
           # TODO: remove in API v5, replaced by *_access_level
           :issues_enabled,
diff --git a/spec/lib/sidebars/projects/menus/deployments_menu_spec.rb b/spec/lib/sidebars/projects/menus/deployments_menu_spec.rb
index 90ff04a20640a2..685ba0c31c759f 100644
--- a/spec/lib/sidebars/projects/menus/deployments_menu_spec.rb
+++ b/spec/lib/sidebars/projects/menus/deployments_menu_spec.rb
@@ -45,30 +45,30 @@
 
         it { is_expected.to be_nil }
       end
+    end
+
+    shared_examples 'split_operations_visibility_permissions FF disabled' do
+      before do
+        stub_feature_flags(split_operations_visibility_permissions: false)
+      end
 
-      describe 'when split_operations_visibility_permissions FF is disabled' do
+      it { is_expected.not_to be_nil }
+
+      context 'and the feature is disabled' do
         before do
-          stub_feature_flags(split_operations_visibility_permissions: false)
+          project.update_attribute("#{item_id}_access_level", 'disabled')
         end
 
         it { is_expected.not_to be_nil }
+      end
 
-        context 'and the feature is disabled' do
-          before do
-            project.update_attribute("#{item_id}_access_level", 'disabled')
-          end
-
-          it { is_expected.not_to be_nil }
+      context 'and operations is disabled' do
+        before do
+          project.update_attribute(:operations_access_level, 'disabled')
         end
 
-        context 'and operations is disabled' do
-          before do
-            project.update_attribute(:operations_access_level, 'disabled')
-          end
-
-          it do
-            is_expected.to be_nil if [:environments, :feature_flags].include?(item_id)
-          end
+        it do
+          is_expected.to be_nil if [:environments, :feature_flags].include?(item_id)
         end
       end
     end
@@ -77,12 +77,14 @@
       let(:item_id) { :feature_flags }
 
       it_behaves_like 'access rights checks'
+      it_behaves_like 'split_operations_visibility_permissions FF disabled'
     end
 
     describe 'Environments' do
       let(:item_id) { :environments }
 
       it_behaves_like 'access rights checks'
+      it_behaves_like 'split_operations_visibility_permissions FF disabled'
     end
 
     describe 'Releases' do
diff --git a/spec/requests/api/project_attributes.yml b/spec/requests/api/project_attributes.yml
index 73b23e8b701b7e..f36a41e6170199 100644
--- a/spec/requests/api/project_attributes.yml
+++ b/spec/requests/api/project_attributes.yml
@@ -129,7 +129,6 @@ project_feature:
     - infrastructure_access_level
     - feature_flags_access_level
     - environments_access_level
-    - releases_access_level
     - project_id
     - updated_at
   computed_attributes:
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 4ffc6055a23766..38f7d6e3eba76c 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -221,6 +221,16 @@
         expect(project_response['container_registry_enabled']).to eq(false)
       end
 
+      it 'includes releases_access_level', :aggregate_failures do
+        project.project_feature.update!(releases_access_level: ProjectFeature::DISABLED)
+
+        get api('/projects', user)
+        project_response = json_response.find { |p| p['id'] == project.id }
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(project_response['releases_access_level']).to eq('disabled')
+      end
+
       context 'when some projects are in a group' do
         before do
           create(:project, :public, group: create(:group))
@@ -1171,6 +1181,7 @@
         attrs[:analytics_access_level] = 'disabled'
         attrs[:container_registry_access_level] = 'private'
         attrs[:security_and_compliance_access_level] = 'private'
+        attrs[:releases_access_level] = 'disabled'
       end
 
       post api('/projects', user), params: project
@@ -1180,7 +1191,7 @@
       project.each_pair do |k, v|
         next if %i[
           has_external_issue_tracker has_external_wiki issues_enabled merge_requests_enabled wiki_enabled storage_version
-          container_registry_access_level
+          container_registry_access_level releases_access_level
         ].include?(k)
 
         expect(json_response[k.to_s]).to eq(v)
@@ -1195,6 +1206,7 @@
       expect(project.project_feature.analytics_access_level).to eq(ProjectFeature::DISABLED)
       expect(project.project_feature.container_registry_access_level).to eq(ProjectFeature::PRIVATE)
       expect(project.project_feature.security_and_compliance_access_level).to eq(ProjectFeature::PRIVATE)
+      expect(project.project_feature.releases_access_level).to eq(ProjectFeature::DISABLED)
     end
 
     it 'assigns container_registry_enabled to project', :aggregate_failures do
@@ -2333,6 +2345,7 @@
         expect(json_response['only_allow_merge_if_all_discussions_are_resolved']).to eq(project.only_allow_merge_if_all_discussions_are_resolved)
         expect(json_response['operations_access_level']).to be_present
         expect(json_response['security_and_compliance_access_level']).to be_present
+        expect(json_response['releases_access_level']).to be_present
       end
 
       it 'exposes all necessary attributes' do
@@ -2402,6 +2415,7 @@ def failure_message(diff)
         expect(json_response['builds_access_level']).to be_present
         expect(json_response['operations_access_level']).to be_present
         expect(json_response['security_and_compliance_access_level']).to be_present
+        expect(json_response['releases_access_level']).to be_present
         expect(json_response).to have_key('emails_disabled')
         expect(json_response['resolve_outdated_diff_discussions']).to eq(project.resolve_outdated_diff_discussions)
         expect(json_response['remove_source_branch_after_merge']).to be_truthy
@@ -3386,6 +3400,14 @@ def failure_message(diff)
       expect(Project.find_by(path: project[:path]).analytics_access_level).to eq(ProjectFeature::PRIVATE)
     end
 
+    it 'sets releases_access_level', :aggregate_failures do
+      put api("/projects/#{project.id}", user), params: { releases_access_level: 'private' }
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response['releases_access_level']).to eq('private')
+      expect(Project.find_by(path: project[:path]).releases_access_level).to eq(ProjectFeature::PRIVATE)
+    end
+
     it 'returns 400 when nothing sent' do
       project_param = {}
 
-- 
GitLab