Add latest changes from gitlab-org/gitlab@master

app/assets/javascripts/mr_popover/queries/merge_request.query.graphql

-query mergeRequest($projectPath: ID!, $mergeRequestIID: String!) {
+query mergeRequest($projectPath: ID!, $mergeRequestIID: ID!) {
   project(fullPath: $projectPath) {
     mergeRequest(iid: $mergeRequestIID) {
       createdAt

app/assets/javascripts/sidebar/queries/sidebarDetails.query.graphql

-query ($fullPath: ID!, $iid: String!) {
+query ($fullPath: ID!, $iid: ID!) {
   project (fullPath: $fullPath) {
     issue (iid: $iid) {
       iid

app/assets/javascripts/sidebar/queries/sidebarDetailsForHealthStatusFeatureFlag.query.graphql

-query ($fullPath: ID!, $iid: String!) {
+query ($fullPath: ID!, $iid: ID!) {
   project (fullPath: $fullPath) {
     issue (iid: $iid) {
       iid

app/graphql/mutations/issues/base.rb

@@ -9,7 +9,7 @@ module Mutations
                required: true,
                description: "The project the issue to mutate is in"
-      argument :iid, GraphQL::STRING_TYPE,
+      argument :iid, GraphQL::ID_TYPE,
                required: true,
                description: "The iid of the issue to mutate"

app/graphql/mutations/merge_requests/base.rb

@@ -9,7 +9,7 @@ module Mutations
                required: true,
                description: "The project the merge request to mutate is in"
-      argument :iid, GraphQL::STRING_TYPE,
+      argument :iid, GraphQL::ID_TYPE,
                required: true,
                description: "The iid of the merge request to mutate"

app/graphql/resolvers/issues_resolver.rb

@@ -2,11 +2,11 @@
 module Resolvers
   class IssuesResolver < BaseResolver
-    argument :iid, GraphQL::STRING_TYPE,
+    argument :iid, GraphQL::ID_TYPE,
               required: false,
               description: 'IID of the issue. For example, "1"'
-    argument :iids, [GraphQL::STRING_TYPE],
+    argument :iids, [GraphQL::ID_TYPE],
               required: false,
               description: 'List of IIDs of issues. For example, [1, 2]'
     argument :state, Types::IssuableStateEnum,

app/graphql/resolvers/merge_requests_resolver.rb

@@ -2,11 +2,11 @@
 module Resolvers
   class MergeRequestsResolver < BaseResolver
-    argument :iid, GraphQL::STRING_TYPE,
+    argument :iid, GraphQL::ID_TYPE,
               required: false,
               description: 'The IID of the merge request, e.g., "1"'
-    argument :iids, [GraphQL::STRING_TYPE],
+    argument :iids, [GraphQL::ID_TYPE],
               required: false,
               description: 'The list of IIDs of issues, e.g., [1, 2]'

app/graphql/types/ci/pipeline_type.rb

@@ -11,7 +11,7 @@ module Types
       field :id, GraphQL::ID_TYPE, null: false,
             description: 'ID of the pipeline'
-      field :iid, GraphQL::STRING_TYPE, null: false,
+      field :iid, GraphQL::ID_TYPE, null: false,
             description: 'Internal ID of the pipeline'
       field :sha, GraphQL::STRING_TYPE, null: false,

app/graphql/types/merge_request_type.rb

@@ -14,7 +14,7 @@ module Types
     field :id, GraphQL::ID_TYPE, null: false,
           description: 'ID of the merge request'
-    field :iid, GraphQL::STRING_TYPE, null: false,
+    field :iid, GraphQL::ID_TYPE, null: false,
           description: 'Internal ID of the merge request'
     field :title, GraphQL::STRING_TYPE, null: false,
           description: 'Title of the merge request'

app/helpers/analytics_navbar_helper.rb

@@ -31,7 +31,6 @@ module AnalyticsNavbarHelper
   end
   def cycle_analytics_navbar_link(project, current_user)
-    return unless Feature.enabled?(:analytics_pages_under_project_analytics_sidebar, project, default_enabled: true)
     return unless project_nav_tab?(:cycle_analytics)
     navbar_sub_item(
@@ -43,7 +42,6 @@ module AnalyticsNavbarHelper
   end
   def repository_analytics_navbar_link(project, current_user)
-    return if Feature.disabled?(:analytics_pages_under_project_analytics_sidebar, project, default_enabled: true)
     return if project.empty_repo?
     navbar_sub_item(
@@ -55,7 +53,6 @@ module AnalyticsNavbarHelper
   end
   def ci_cd_analytics_navbar_link(project, current_user)
-    return unless Feature.enabled?(:analytics_pages_under_project_analytics_sidebar, project, default_enabled: true)
     return unless project_nav_tab?(:pipelines)
     return unless project.feature_available?(:builds, current_user) || !project.empty_repo?

app/models/namespace.rb

@@ -130,7 +130,7 @@ class Namespace < ApplicationRecord
       return unless host.ends_with?(gitlab_host)
       name = host.delete_suffix(gitlab_host)
-      Namespace.find_by_path(name)
+      Namespace.where(parent_id: nil).find_by_path(name)
     end
     # overridden in ee

app/models/user.rb

@@ -164,6 +164,7 @@ class User < ApplicationRecord
   has_one :status, class_name: 'UserStatus'
   has_one :user_preference
   has_one :user_detail
+  has_one :user_highest_role
   #
   # Validations

app/models/user_highest_role.rb

+# frozen_string_literal: true
+
+class UserHighestRole < ApplicationRecord
+  belongs_to :user, optional: false
+
+  validates :highest_access_level, allow_nil: true, inclusion: { in: Gitlab::Access.all_values }
+end

app/uploaders/avatar_uploader.rb

@@ -5,9 +5,8 @@ class AvatarUploader < GitlabUploader
   include RecordsUploads::Concern
   include ObjectStorage::Concern
   prepend ObjectStorage::Extension::RecordsUploads
-  include UploadTypeCheck::Concern
-  check_upload_type extensions: AvatarUploader::SAFE_IMAGE_EXT
+  MIME_WHITELIST = %w[image/png image/jpeg image/gif image/bmp image/tiff image/vnd.microsoft.icon].freeze
   def exists?
     model.avatar.file && model.avatar.file.present?
@@ -29,6 +28,10 @@ class AvatarUploader < GitlabUploader
     super || 'avatar'
   end
+  def content_type_whitelist
+    MIME_WHITELIST
+  end
+
   private
   def dynamic_segment

app/uploaders/content_type_whitelist.rb

+# frozen_string_literal: true
+
+# Currently we run CarrierWave 1.3.1 which means we can not whitelist files
+# by their content type through magic header parsing.
+#
+# This is a patch to hold us over until we get to CarrierWave 2 :) It's a mashup of
+# CarrierWave's lib/carrierwave/uploader/content_type_whitelist.rb and
+# lib/carrierwave/sanitized_file.rb
+#
+# Include this concern and add a content_type_whitelist method to get the same
+# behavior as you would with CarrierWave 2.
+#
+# This is not an exact replacement as we don't override
+# SanitizedFile#content_type but we do set the content_type attribute when we
+# check the whitelist.
+#
+# Remove this after moving to CarrierWave 2, though on practical terms it shouldn't
+# break anything if left for a while.
+module ContentTypeWhitelist
+  module Concern
+    extend ActiveSupport::Concern
+
+    private
+
+    # CarrierWave calls this method as part of it's before :cache callbacks.
+    # Here we override and extend CarrierWave's method that does not parse the
+    # magic headers.
+    def check_content_type_whitelist!(new_file)
+      new_file.content_type = mime_magic_content_type(new_file.path)
+
+      if content_type_whitelist && !whitelisted_content_type?(new_file.content_type)
+        message = I18n.translate(:"errors.messages.content_type_whitelist_error", allowed_types: Array(content_type_whitelist).join(", "))
+        raise CarrierWave::IntegrityError, message
+      end
+
+      super(new_file)
+    end
+
+    def whitelisted_content_type?(content_type)
+      Array(content_type_whitelist).any? { |item| content_type =~ /#{item}/ }
+    end
+
+    def mime_magic_content_type(path)
+      if path
+        File.open(path) do |file|
+          MimeMagic.by_magic(file).try(:type) || 'invalid/invalid'
+        end
+      end
+    rescue Errno::ENOENT
+      nil
+    end
+  end
+end

app/uploaders/favicon_uploader.rb

 # frozen_string_literal: true
 class FaviconUploader < AttachmentUploader
-  include UploadTypeCheck::Concern
-
   EXTENSION_WHITELIST = %w[png ico].freeze
-
-  check_upload_type extensions: EXTENSION_WHITELIST
+  MIME_WHITELIST = %w[image/png image/vnd.microsoft.icon].freeze
   def extension_whitelist
     EXTENSION_WHITELIST
   end
+  def content_type_whitelist
+    MIME_WHITELIST
+  end
+
   private
   def filename_for_different_format(filename, format)

app/uploaders/gitlab_uploader.rb

 # frozen_string_literal: true
 class GitlabUploader < CarrierWave::Uploader::Base
+  include ContentTypeWhitelist::Concern
+
   class_attribute :options
   class << self

app/views/layouts/nav/sidebar/_group.html.haml

-- should_display_analytics_pages_in_sidebar = Feature.enabled?(:analytics_pages_under_group_analytics_sidebar, @group, default_enabled: true)
 - issues_count = group_issues_count(state: 'opened')
 - merge_requests_count = group_merge_requests_count(state: 'opened')
@@ -13,8 +12,7 @@
     %ul.sidebar-top-level-items.qa-group-sidebar
       - if group_sidebar_link?(:overview)
         - paths = group_overview_nav_link_paths
-        - paths << 'contribution_analytics#show' unless should_display_analytics_pages_in_sidebar
-        = nav_link(path: paths, unless: -> { should_display_analytics_pages_in_sidebar && current_path?('groups/contribution_analytics#show') }, html_options: { class: 'home' }) do
+        = nav_link(path: paths, unless: -> { current_path?('groups/contribution_analytics#show') }, html_options: { class: 'home' }) do
           = link_to group_path(@group) do
             .nav-icon-container
               = sprite_icon('home')
@@ -45,19 +43,10 @@
                   %span
                     = _('Activity')
-            - unless should_display_analytics_pages_in_sidebar
-              - if group_sidebar_link?(:contribution_analytics)
-                = nav_link(path: 'contribution_analytics#show') do
-                  = link_to group_contribution_analytics_path(@group), title: _('Contribution'), data: { placement: 'right', qa_selector: 'contribution_analytics_link' } do
-                    %span
-                      = _('Contribution')
-
-              = render_if_exists 'layouts/nav/group_insights_link'
-
       = render_if_exists "layouts/nav/ee/epic_link", group: @group
       - if group_sidebar_link?(:issues)
-        = nav_link(path: group_issues_sub_menu_items, unless: -> { should_display_analytics_pages_in_sidebar && current_path?('issues_analytics#show') }) do
+        = nav_link(path: group_issues_sub_menu_items, unless: -> { current_path?('issues_analytics#show') }) do
           = link_to issues_group_path(@group), data: { qa_selector: 'group_issues_item' } do
             .nav-icon-container
               = sprite_icon('issues')
@@ -84,9 +73,6 @@
                   %span
                     = boards_link_text
-            - unless should_display_analytics_pages_in_sidebar
-              = render_if_exists 'layouts/nav/issues_analytics_link'
-
             - if group_sidebar_link?(:labels)
               = nav_link(path: 'labels#index') do
                 = link_to group_labels_path(@group), title: _('Labels') do

app/views/layouts/nav/sidebar/_project.html.haml

-- should_display_analytics_pages_in_sidebar = Feature.enabled?(:analytics_pages_under_project_analytics_sidebar, @project, default_enabled: true)
-
 .nav-sidebar{ class: ("sidebar-collapsed-desktop" if collapsed_sidebar?) }
   .nav-sidebar-inner-scroll
     - can_edit = can?(current_user, :admin_project, @project)
@@ -10,9 +8,7 @@
         .sidebar-context-title
           = @project.name
     %ul.sidebar-top-level-items.qa-project-sidebar
-      - paths = sidebar_projects_paths
-      - paths << 'cycle_analytics#show' unless should_display_analytics_pages_in_sidebar
-      = nav_link(path: paths, html_options: { class: 'home' }) do
+      = nav_link(path: sidebar_projects_paths, html_options: { class: 'home' }) do
         = link_to project_path(@project), class: 'shortcuts-project rspec-project-link', data: { qa_selector: 'project_link' } do
           .nav-icon-container
             = sprite_icon('home')
@@ -39,17 +35,8 @@
                 %span= _('Releases')
-          - unless should_display_analytics_pages_in_sidebar
-            - if can?(current_user, :read_cycle_analytics, @project)
-              = nav_link(path: 'cycle_analytics#show') do
-                = link_to project_cycle_analytics_path(@project), title: _('Value Stream'), class: 'shortcuts-project-cycle-analytics' do
-                  %span= _('Value Stream')
-
-            = render_if_exists 'layouts/nav/project_insights_link'
-
-
       - if project_nav_tab? :files
-        = nav_link(controller: sidebar_repository_paths, unless: -> { should_display_analytics_pages_in_sidebar && current_path?('projects/graphs#charts') }) do
+        = nav_link(controller: sidebar_repository_paths, unless: -> { current_path?('projects/graphs#charts') }) do
           = link_to project_tree_path(@project), class: 'shortcuts-tree qa-project-menu-repo' do
             .nav-icon-container
               = sprite_icon('doc-text')
@@ -90,11 +77,6 @@
               = link_to project_compare_index_path(@project, from: @repository.root_ref, to: current_ref) do
                 = _('Compare')
-            - unless should_display_analytics_pages_in_sidebar
-              = nav_link(path: 'graphs#charts') do
-                = link_to charts_project_graph_path(@project, current_ref) do
-                  = _('Charts')
-
             = render_if_exists 'projects/sidebar/repository_locked_files'
       - if project_nav_tab? :issues
@@ -178,7 +160,7 @@
                   = number_with_delimiter(@project.open_merge_requests_count)
       - if project_nav_tab? :pipelines
-        = nav_link(controller: [:pipelines, :builds, :jobs, :pipeline_schedules, :artifacts], unless: -> { should_display_analytics_pages_in_sidebar && current_path?('projects/pipelines#charts') }) do
+        = nav_link(controller: [:pipelines, :builds, :jobs, :pipeline_schedules, :artifacts], unless: -> { current_path?('projects/pipelines#charts') }) do
           = link_to project_pipelines_path(@project), class: 'shortcuts-pipelines qa-link-pipelines rspec-link-pipelines', data: { qa_selector: 'ci_cd_link' } do
             .nav-icon-container
               = sprite_icon('rocket')
@@ -215,12 +197,6 @@
                   %span
                     = _('Schedules')
-            - if !should_display_analytics_pages_in_sidebar && @project.feature_available?(:builds, current_user) && !@project.empty_repo?
-              = nav_link(path: 'pipelines#charts') do
-                = link_to charts_project_pipelines_path(@project), title: _('Charts'), class: 'shortcuts-pipelines-charts' do
-                  %span
-                    = _('Charts')
-
       = render_if_exists 'layouts/nav/sidebar/project_security_link' # EE-specific
       - if project_nav_tab? :operations
@@ -426,13 +402,6 @@
           = link_to project_network_path(@project, current_ref), title: _('Network'), class: 'shortcuts-network' do
             = _('Graph')
-      - unless should_display_analytics_pages_in_sidebar
-        -# Shortcut to Repository > Charts (formerly, top-nav item "Graphs")
-        - unless @project.empty_repo?
-          %li.hidden
-            = link_to charts_project_graph_path(@project, current_ref), title: _('Charts'), class: 'shortcuts-repository-charts' do
-              = _('Charts')
-
       -# Shortcut to Issues > New Issue
       - if project_nav_tab?(:issues)
         %li.hidden