Make possible to create confidential issue via API

doc/api/issues.md

@@ -78,7 +78,8 @@ Example response:
       "iid" : 6,
       "labels" : [],
       "subscribed" : false,
-      "user_notes_count": 1
+      "user_notes_count": 1,
+      "confidential": false
    }
 ]
 ```
@@ -156,7 +157,8 @@ Example response:
       "updated_at" : "2016-01-04T15:31:46.176Z",
       "created_at" : "2016-01-04T15:31:46.176Z",
       "subscribed" : false,
-      "user_notes_count": 1
+      "user_notes_count": 1,
+      "confidential": false
    }
 ]
 ```
@@ -219,7 +221,8 @@ Example response:
    "updated_at" : "2016-01-04T15:31:46.176Z",
    "created_at" : "2016-01-04T15:31:46.176Z",
    "subscribed": false,
-   "user_notes_count": 1
+   "user_notes_count": 1,
+   "confidential": false
 }
 ```
@@ -244,6 +247,7 @@ POST /projects/:id/issues
 | `milestone_id`  | integer | no  | The ID of a milestone to assign issue |
 | `labels`        | string  | no  | Comma-separated label names for an issue  |
 | `created_at`    | string  | no  | Date time string, ISO 8601 formatted, e.g. `2016-03-11T03:45:40Z` |
+| `confidential`  | boolean | no  | Set to true if issue should be marked as _confidential_ |
 ```bash
 curl -X POST -H "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" https://gitlab.example.com/api/v3/projects/4/issues?title=Issues%20with%20auth&labels=bug
@@ -275,7 +279,8 @@ Example response:
    "updated_at" : "2016-01-07T12:44:33.959Z",
    "milestone" : null,
    "subscribed" : true,
-   "user_notes_count": 0
+   "user_notes_count": 0,
+   "confidential": false
 }
 ```
@@ -334,7 +339,8 @@ Example response:
    "assignee" : null,
    "milestone" : null,
    "subscribed" : true,
-   "user_notes_count": 0
+   "user_notes_count": 0,
+   "confidential": false
 }
 ```
@@ -411,7 +417,8 @@ Example response:
     "state": "active",
     "avatar_url": "http://www.gravatar.com/avatar/7a190fecbaa68212a4b68aeb6e3acd10?s=80&d=identicon",
     "web_url": "https://gitlab.example.com/u/solon.cremin"
-  }
+  },
+  "confidential": false
 }
 ```
@@ -465,7 +472,8 @@ Example response:
     "state": "active",
     "avatar_url": "http://www.gravatar.com/avatar/7a190fecbaa68212a4b68aeb6e3acd10?s=80&d=identicon",
     "web_url": "https://gitlab.example.com/u/solon.cremin"
-  }
+  },
+  "confidential": false
 }
 ```
@@ -520,7 +528,8 @@ Example response:
     "avatar_url": "http://www.gravatar.com/avatar/5224fd70153710e92fb8bcf79ac29d67?s=80&d=identicon",
     "web_url": "http://lgitlab.example.com/u/orville"
   },
-  "subscribed": false
+  "subscribed": false,
+  "confidential": false
 }
 ```

lib/api/entities.rb

@@ -168,6 +168,7 @@ module API
       expose :label_names, as: :labels
       expose :milestone, using: Entities::Milestone
       expose :assignee, :author, using: Entities::UserBasic
+      expose :confidential
       expose :subscribed do |issue, options|
         issue.subscribed?(options[:current_user])

lib/api/issues.rb

@@ -122,7 +122,7 @@ module API
       post ":id/issues" do
         required_attributes! [:title]
-        keys = [:title, :description, :assignee_id, :milestone_id]
+        keys = [:title, :description, :assignee_id, :milestone_id, :confidential]
         keys << :created_at if current_user.admin? || user_project.owner == current_user
         attrs = attributes_for_keys(keys)

spec/requests/api/issues_spec.rb

@@ -333,6 +333,17 @@ describe API::API, api: true  do
       expect(json_response['title']).to eq('new issue')
       expect(json_response['description']).to be_nil
       expect(json_response['labels']).to eq(['label', 'label2'])
+      expect(json_response['confidential']).to be_falsey
+    end
+
+    it "should create a new confidential project issue" do
+      post api("/projects/#{project.id}/issues", user),
+        title: 'new issue', labels: 'label, label2', confidential: true
+      expect(response.status).to eq(201)
+      expect(json_response['title']).to eq('new issue')
+      expect(json_response['description']).to be_nil
+      expect(json_response['labels']).to eq(['label', 'label2'])
+      expect(json_response['confidential']).to be_truthy
     end
     it "should return a 400 bad request if title not given" do