Add latest changes from gitlab-org/gitlab@master

doc/integration/vault.md

+---
+type: reference, howto
+---
+
+# Vault Authentication with GitLab OpenID Connect
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/22323) in GitLab 9.0
+
+[Vault](https://www.vaultproject.io/) is a secrets management application offered by HashiCorp.
+It allows you to store and manage sensitive information such secret environment variables, encryption keys, and authentication tokens.
+Vault offers Identity-based Access, which means Vault users can authenticate through several of their preferred cloud providers.
+
+In this document, we'll explain how Vault users can authenticate themselves through GitLab by utilizing our OpenID authentication feature.
+The following assumes you already have Vault installed and running.
+
+1. **Get the OpenID Connect client ID and secret from GitLab:**
+
+    First you'll need to create a GitLab application to obtain an application ID and secret for authenticating into Vault. To do this, sign in to GitLab and follow these steps:
+
+    1. On GitLab, click your avatar on the top-right corner, and select your user **Settings > Applications**.
+    1. Fill out the application **Name** and [**Redirect URI**](https://www.vaultproject.io/docs/auth/jwt.html#redirect-uris),
+    making sure to select the **openid** scope.
+    1. Save application.
+    1. Copy client ID and secret, or keep the page open for reference.
+    ![GitLab OAuth provider](img/gitlab_oauth_vault_v12_6.png)
+
+1. **Enable OIDC auth on Vault:**
+
+    OpenID Connect is not enabled in Vault by default. This needs to be enabled in the terminal.
+
+    Open a terminal session and run the following command to enable the OpenID Connect authentication provider in Vault:
+
+    ```bash
+    vault auth enable oidc
+    ```
+
+    You should see the following output in the terminal:
+
+    ```bash
+    Success! Enabled oidc auth method at: oidc/
+    ```
+
+1. **Write the OIDC config:**
+
+    Next, Vault needs to be given the application ID and secret generated by Gitlab.
+
+    In the terminal session, run the following command to give Vault access to the GitLab application you've just created with an OpenID scope. This allows Vault to authenticate through GitLab.
+
+    Replace `your_application_id` and `your_secret` in the example below with the application ID and secret generated for your app:
+
+    ```bash
+    $ vault write auth/oidc/config \
+        oidc_discovery_url="https://gitlab.com" \
+        oidc_client_id="your_application_id" \
+        oidc_client_secret="your_secret" \
+        default_role="demo" \
+        bound_issuer="localhost"
+    ```
+
+    You should see the following output in the terminal:
+
+    ```bash
+    Success! Data written to: auth/oidc/config
+    ```
+
+1. **Write the OIDC Role Config:**
+
+    Now that Vault has a GitLab application ID and secret, it needs to know the [**Redirect URIs**](https://www.vaultproject.io/docs/auth/jwt.html#redirect-uris) and scopes given to GitLab during the application creation process. The redirect URIs need to match where your Vault instance is running. The `oidc_scopes` field needs to include the `openid`.  Similarly to the previous step, replace `your_application_id` with the generated application ID from GitLab:
+
+    This configuration is saved under the name of the role you are creating. In this case, we are creating a `demo` role. Later, we'll show how you can access this role through the Vault CLI.
+
+    ```bash
+    vault write auth/oidc/role/demo \
+          user_claim="sub" \
+          allowed_redirect_uris="http://localhost:8250/oidc/callback,http://127.0.0.1:8200/ui/vault/auth/oidc/oidc/callback" \
+          bound_audiences="your_application_id" \
+          role_type="oidc" \
+          oidc_scopes="openid" \
+          policies=demo \
+          ttl=1h
+    ```
+
+1. **Sign in to Vault:**
+
+    1. Go to your Vault UI (example: [http://127.0.0.1:8200/ui/vault/auth?with=oidc](http://127.0.0.1:8200/ui/vault/auth?with=oidc)).
+    1. If the `OIDC` method is not currently selected, open the dropdown and select it.
+    1. Click the **Sign in With GitLab** button, which will open a modal window:
+    ![Sign into Vault with GitLab](img/sign_into_vault_with_gitlab_v12_6.png)
+
+    1. Click **Authorize** on the modal to allow Vault to sign in through GitLab. This will redirect you back to your Vault UI as a signed-in user.
+    ![Authorize Vault to connect with GitLab](img/authorize_vault_with_gitlab_v12_6.png)
+
+1. **Sign in using the Vault CLI** (optional):
+
+    Vault also allows you to sign in via their CLI.
+
+    After writing the same configurations from above, you can run the command below in your terminal to sign in with the role configuration created in step 4 above:
+
+    ```bash
+    vault login -method=oidc port=8250 role=demo
+    ```
+
+    Here is a short explaination of what this command does:
+
+    1. In the **Write the OIDC Role Config** (step 4), we created a role called `demo`. We set `role=demo` so Vault knows which configuration we'd like to login in with.
+    1. To set Vault to use the `OIDC` sign-in method, we set `-method=oidc`.
+    1. To set the port that GitLab should redirect to, we set `port=8250` or another port number that matches the port given to GitLab when listing [Redirect URIs](https://www.vaultproject.io/docs/auth/jwt.html#redirect-uris).
+
+    Once you run the command above, it will present a link in the terminal.
+    Click the link in the terminal and a tab will open in the browser confirming you're signed into Vault via OIDC:
+
+    ![Signed into Vault via OIDC](img/signed_into_vault_via_oidc_v12_6.png)
+
+    The terminal will output:
+
+    ```
+    Success! You are now authenticated. The token information displayed below
+    is already stored in the token helper. You do NOT need to run "vault login"
+    again. Future Vault requests will automatically use this token.
+    ```

lib/api/entities.rb

@@ -176,7 +176,7 @@ module API
     end
     class BasicProjectDetails < ProjectIdentity
-      include ::API::ProjectsRelationBuilder
+      include ::API::ProjectsBatchCounting
       expose :default_branch, if: -> (project, options) { Ability.allowed?(options[:current_user], :download_code, project) }
       # Avoids an N+1 query: https://github.com/mbleigh/acts-as-taggable-on/issues/91#issuecomment-168273770
@@ -418,7 +418,7 @@ module API
           options: { only_owned: true }
         ).execute
-        Entities::Project.prepare_relation(projects)
+        Entities::Project.preload_and_batch_count!(projects)
       end
       expose :shared_projects, using: Entities::Project do |group, options|
@@ -428,7 +428,7 @@ module API
           options: { only_shared: true }
         ).execute
-        Entities::Project.prepare_relation(projects)
+        Entities::Project.preload_and_batch_count!(projects)
       end
     end

lib/api/groups.rb

@@ -231,7 +231,7 @@ module API
         projects, options = with_custom_attributes(projects, options)
-        present options[:with].prepare_relation(projects), options
+        present options[:with].preload_and_batch_count!(projects), options
       end
       desc 'Get a list of subgroups in this group.' do

lib/api/helpers/pagination.rb

@@ -3,8 +3,33 @@
 module API
   module Helpers
     module Pagination
+      # This returns an ActiveRecord relation
       def paginate(relation)
-        ::Gitlab::Pagination::OffsetPagination.new(self).paginate(relation)
+        Gitlab::Pagination::OffsetPagination.new(self).paginate(relation)
+      end
+
+      # This applies pagination and executes the query
+      # It always returns an array instead of an ActiveRecord relation
+      def paginate_and_retrieve!(relation)
+        offset_or_keyset_pagination(relation).to_a
+      end
+
+      private
+
+      def offset_or_keyset_pagination(relation)
+        return paginate(relation) unless keyset_pagination_enabled?
+
+        request_context = Gitlab::Pagination::Keyset::RequestContext.new(self)
+
+        unless Gitlab::Pagination::Keyset.available?(request_context, relation)
+          return error!('Keyset pagination is not yet available for this type of request', 405)
+        end
+
+        Gitlab::Pagination::Keyset.paginate(request_context, relation)
+      end
+
+      def keyset_pagination_enabled?
+        params[:pagination] == 'keyset' && Feature.enabled?(:api_keyset_pagination, default_enabled: true)
       end
     end
   end

lib/api/pipelines.rb

@@ -25,6 +25,8 @@ module API
         optional :yaml_errors, type: Boolean, desc: 'Returns pipelines with invalid configurations'
         optional :name,     type: String, desc: 'The name of the user who triggered pipelines'
         optional :username, type: String, desc: 'The username of the user who triggered pipelines'
+        optional :updated_before, type: DateTime, desc: 'Return pipelines updated before the specified datetime. Format: ISO 8601 YYYY-MM-DDTHH:MM:SSZ'
+        optional :updated_after, type: DateTime, desc: 'Return pipelines updated after the specified datetime. Format: ISO 8601 YYYY-MM-DDTHH:MM:SSZ'
         optional :order_by, type: String, values: PipelinesFinder::ALLOWED_INDEXED_COLUMNS, default: 'id',
                             desc: 'Order pipelines'
         optional :sort,     type: String, values: %w[asc desc], default: 'desc',

lib/api/projects.rb

@@ -75,15 +75,17 @@ module API
         mutually_exclusive :import_url, :template_name, :template_project_id
       end
-      def load_projects
+      def find_projects
         ProjectsFinder.new(current_user: current_user, params: project_finder_params).execute
       end
-      def present_projects(projects, options = {})
+      # Prepare the full projects query
+      # None of this is supposed to actually execute any database query
+      def prepare_query(projects)
         projects = reorder_projects(projects)
         projects = apply_filters(projects)
-        projects = paginate(projects)
-        projects, options = with_custom_attributes(projects, options)
+
+        projects, options = with_custom_attributes(projects)
         options = options.reverse_merge(
           with: current_user ? Entities::ProjectWithAccess : Entities::BasicProjectDetails,
@@ -91,9 +93,23 @@ module API
           current_user: current_user,
           license: false
         )
+
         options[:with] = Entities::BasicProjectDetails if params[:simple]
-        present options[:with].prepare_relation(projects, options), options
+        projects = options[:with].preload_relation(projects, options)
+
+        [projects, options]
+      end
+
+      def prepare_and_present(project_relation)
+        projects, options = prepare_query(project_relation)
+
+        projects = paginate_and_retrieve!(projects)
+
+        # Refresh count caches
+        options[:with].execute_batch_counting(projects)
+
+        present projects, options
       end
       def translate_params_for_compatibility(params)
@@ -118,7 +134,7 @@ module API
         params[:user] = user
-        present_projects load_projects
+        prepare_and_present find_projects
       end
       desc 'Get projects starred by a user' do
@@ -134,7 +150,7 @@ module API
         not_found!('User') unless user
         starred_projects = StarredProjectsFinder.new(user, params: project_finder_params, current_user: current_user).execute
-        present_projects starred_projects
+        prepare_and_present starred_projects
       end
     end
@@ -150,7 +166,7 @@ module API
         use :with_custom_attributes
       end
       get do
-        present_projects load_projects
+        prepare_and_present find_projects
       end
       desc 'Create new project' do
@@ -287,7 +303,7 @@ module API
       get ':id/forks' do
         forks = ForkProjectsFinder.new(user_project, params: project_finder_params, current_user: current_user).execute
-        present_projects forks
+        prepare_and_present forks
       end
       desc 'Check pages access of this project'

lib/api/projects_batch_counting.rb

+# frozen_string_literal: true
+
+module API
+  module ProjectsBatchCounting
+    extend ActiveSupport::Concern
+
+    class_methods do
+      # This adds preloading to the query and executes batch counting
+      # Side-effect: The query will be executed during batch counting
+      def preload_and_batch_count!(projects_relation)
+        preload_relation(projects_relation).tap do |projects|
+          execute_batch_counting(projects)
+        end
+      end
+
+      def execute_batch_counting(projects)
+        ::Projects::BatchForksCountService.new(forks_counting_projects(projects)).refresh_cache
+
+        ::Projects::BatchOpenIssuesCountService.new(projects).refresh_cache
+      end
+
+      def forks_counting_projects(projects)
+        projects
+      end
+    end
+  end
+end

lib/api/projects_relation_builder.rb

-# frozen_string_literal: true
-
-module API
-  module ProjectsRelationBuilder
-    extend ActiveSupport::Concern
-
-    class_methods do
-      def prepare_relation(projects_relation, options = {})
-        projects_relation = preload_relation(projects_relation, options)
-        execute_batch_counting(projects_relation)
-        projects_relation
-      end
-
-      def preload_relation(projects_relation, options = {})
-        projects_relation
-      end
-
-      def forks_counting_projects(projects_relation)
-        projects_relation
-      end
-
-      def batch_forks_counting(projects_relation)
-        ::Projects::BatchForksCountService.new(forks_counting_projects(projects_relation)).refresh_cache
-      end
-
-      def batch_open_issues_counting(projects_relation)
-        ::Projects::BatchOpenIssuesCountService.new(projects_relation).refresh_cache
-      end
-
-      def execute_batch_counting(projects_relation)
-        batch_forks_counting(projects_relation)
-        batch_open_issues_counting(projects_relation)
-      end
-    end
-  end
-end

lib/gitlab/auth/user_auth_finders.rb

@@ -169,6 +169,8 @@ module Gitlab
         case request_format
         when :archive
           archive_request?
+        when :blob
+          blob_request?
         else
           false
         end
@@ -189,6 +191,10 @@ module Gitlab
       def archive_request?
         current_request.path.include?('/-/archive/')
       end
+
+      def blob_request?
+        current_request.path.include?('/raw/')
+      end
     end
   end
 end

lib/gitlab/pagination/keyset.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Pagination
+    module Keyset
+      def self.paginate(request_context, relation)
+        Gitlab::Pagination::Keyset::Pager.new(request_context).paginate(relation)
+      end
+
+      def self.available?(request_context, relation)
+        order_by = request_context.page.order_by
+
+        # This is only available for Project and order-by id (asc/desc)
+        return false unless relation.klass == Project
+        return false unless order_by.size == 1 && order_by[:id]
+
+        true
+      end
+    end
+  end
+end

lib/gitlab/pagination/keyset/page.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Pagination
+    module Keyset
+      # A Page models the pagination information for a particular page of the collection
+      class Page
+        # Default number of records for a page
+        DEFAULT_PAGE_SIZE = 20
+
+        # Maximum number of records for a page
+        MAXIMUM_PAGE_SIZE = 100
+
+        attr_accessor :lower_bounds, :end_reached
+        attr_reader :order_by
+
+        def initialize(order_by: {}, lower_bounds: nil, per_page: DEFAULT_PAGE_SIZE, end_reached: false)
+          @order_by = order_by.symbolize_keys
+          @lower_bounds = lower_bounds&.symbolize_keys
+          @per_page = per_page
+          @end_reached = end_reached
+        end
+
+        # Number of records to return per page
+        def per_page
+          return DEFAULT_PAGE_SIZE if @per_page <= 0
+
+          [@per_page, MAXIMUM_PAGE_SIZE].min
+        end
+
+        # Determine whether this page indicates the end of the collection
+        def end_reached?
+          @end_reached
+        end
+
+        # Construct a Page for the next page
+        # Uses identical order_by/per_page information for the next page
+        def next(lower_bounds, end_reached)
+          dup.tap do |next_page|
+            next_page.lower_bounds = lower_bounds&.symbolize_keys
+            next_page.end_reached = end_reached
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/pagination/keyset/pager.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Pagination
+    module Keyset
+      class Pager
+        attr_reader :request
+
+        def initialize(request)
+          @request = request
+        end
+
+        def paginate(relation)
+          # Validate assumption: The last two columns must match the page order_by
+          validate_order!(relation)
+
+          # This performs the database query and retrieves records
+          # We retrieve one record more to check if we have data beyond this page
+          all_records = relation.limit(page.per_page + 1).to_a # rubocop: disable CodeReuse/ActiveRecord
+
+          records_for_page = all_records.first(page.per_page)
+
+          # If we retrieved more records than belong on this page,
+          # we know there's a next page
+          there_is_more = all_records.size > records_for_page.size
+          apply_headers(records_for_page.last, there_is_more)
+
+          records_for_page
+        end
+
+        private
+
+        def apply_headers(last_record_in_page, there_is_more)
+          end_reached = last_record_in_page.nil? || !there_is_more
+          lower_bounds = last_record_in_page&.slice(page.order_by.keys)
+
+          next_page = page.next(lower_bounds, end_reached)
+
+          request.apply_headers(next_page)
+        end
+
+        def page
+          @page ||= request.page
+        end
+
+        def validate_order!(rel)
+          present_order = rel.order_values.map { |val| [val.expr.name.to_sym, val.direction] }.last(2).to_h
+
+          unless page.order_by == present_order
+            raise ArgumentError, "Page's order_by does not match the relation's order: #{present_order} vs #{page.order_by}"
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/pagination/keyset/request_context.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Pagination
+    module Keyset
+      class RequestContext
+        attr_reader :request
+
+        DEFAULT_SORT_DIRECTION = :desc
+        PRIMARY_KEY = :id
+
+        # A tie breaker is added as an additional order-by column
+        # to establish a well-defined order. We use the primary key
+        # column here.
+        TIE_BREAKER = { PRIMARY_KEY => DEFAULT_SORT_DIRECTION }.freeze
+
+        def initialize(request)
+          @request = request
+        end
+
+        # extracts Paging information from request parameters
+        def page
+          @page ||= Page.new(order_by: order_by, per_page: params[:per_page])
+        end
+
+        def apply_headers(next_page)
+          request.header('Links', pagination_links(next_page))
+        end
+
+        private
+
+        def order_by
+          return TIE_BREAKER.dup unless params[:order_by]
+
+          order_by = { params[:order_by].to_sym => params[:sort]&.to_sym || DEFAULT_SORT_DIRECTION }
+
+          # Order by an additional unique key, we use the primary key here
+          order_by = order_by.merge(TIE_BREAKER) unless order_by[PRIMARY_KEY]
+
+          order_by
+        end
+
+        def params
+          @params ||= request.params
+        end
+
+        def lower_bounds_params(page)
+          page.lower_bounds.each_with_object({}) do |(column, value), params|
+            filter = filter_with_comparator(page, column)
+            params[filter] = value
+          end
+        end
+
+        def filter_with_comparator(page, column)
+          direction = page.order_by[column]
+
+          if direction&.to_sym == :desc
+            "#{column}_before"
+          else
+            "#{column}_after"
+          end
+        end
+
+        def page_href(page)
+          base_request_uri.tap do |uri|
+            uri.query = query_params_for(page).to_query
+          end.to_s
+        end
+
+        def pagination_links(next_page)
+          return if next_page.end_reached?
+
+          %(<#{page_href(next_page)}>; rel="next")
+        end
+
+        def base_request_uri
+          @base_request_uri ||= URI.parse(request.request.url).tap do |uri|
+            uri.host = Gitlab.config.gitlab.host
+            uri.port = Gitlab.config.gitlab.port
+          end
+        end
+
+        def query_params_for(page)
+          request.params.merge(lower_bounds_params(page))
+        end
+      end
+    end
+  end
+end

lib/sentry/client.rb

@@ -206,7 +206,7 @@ module Sentry
       uri = URI(url)
       uri.path.squeeze!('/')
-      # Remove trailing spaces
+      # Remove trailing slash
       uri = uri.to_s.gsub(/\/\z/, '')
       uri

locale/gitlab.pot

@@ -6993,7 +6993,7 @@ msgstr ""
 msgid "ErrorTracking|Connection has failed. Re-check Auth Token and try again."
 msgstr ""
-msgid "ErrorTracking|Find your hostname in your Sentry account settings page"
+msgid "ErrorTracking|If you self-host Sentry, enter the full URL of your Sentry instance. If you're using Sentry's hosted solution, enter https://sentry.io"
 msgstr ""
 msgid "ErrorTracking|No projects available"

spec/controllers/projects/raw_controller_spec.rb

@@ -77,6 +77,24 @@ describe Projects::RawController do
         execute_raw_requests(requests: 6, project: project, file_path: file_path)
       end
+      context 'when receiving an external storage request' do
+        let(:token) { 'letmein' }
+
+        before do
+          stub_application_setting(
+            static_objects_external_storage_url: 'https://cdn.gitlab.com',
+            static_objects_external_storage_auth_token: token
+          )
+        end
+
+        it 'does not prevent from accessing the raw file' do
+          request.headers['X-Gitlab-External-Storage-Token'] = token
+          execute_raw_requests(requests: 6, project: project, file_path: file_path)
+
+          expect(response).to have_gitlab_http_status(200)
+        end
+      end
+
       context 'when the request uses a different version of a commit' do
         it 'prevents from accessing the raw file' do
           # 3 times with the normal sha
@@ -131,15 +149,74 @@ describe Projects::RawController do
         end
       end
     end
+
+    context 'as a sessionless user' do
+      let_it_be(:project) { create(:project, :private, :repository) }
+      let_it_be(:user) { create(:user, static_object_token: 'very-secure-token') }
+      let_it_be(:file_path) { 'master/README.md' }
+
+      before do
+        project.add_developer(user)
+      end
+
+      context 'when no token is provided' do
+        it 'redirects to sign in page' do
+          execute_raw_requests(requests: 1, project: project, file_path: file_path)
+
+          expect(response).to have_gitlab_http_status(302)
+          expect(response.location).to end_with('/users/sign_in')
+        end
+      end
+
+      context 'when a token param is present' do
+        context 'when token is correct' do
+          it 'calls the action normally' do
+            execute_raw_requests(requests: 1, project: project, file_path: file_path, token: user.static_object_token)
+
+            expect(response).to have_gitlab_http_status(200)
+          end
+        end
+
+        context 'when token is incorrect' do
+          it 'redirects to sign in page' do
+            execute_raw_requests(requests: 1, project: project, file_path: file_path, token: 'foobar')
+
+            expect(response).to have_gitlab_http_status(302)
+            expect(response.location).to end_with('/users/sign_in')
+          end
+        end
+      end
+
+      context 'when a token header is present' do
+        context 'when token is correct' do
+          it 'calls the action normally' do
+            request.headers['X-Gitlab-Static-Object-Token'] = user.static_object_token
+            execute_raw_requests(requests: 1, project: project, file_path: file_path)
+
+            expect(response).to have_gitlab_http_status(200)
+          end
+        end
+
+        context 'when token is incorrect' do
+          it 'redirects to sign in page' do
+            request.headers['X-Gitlab-Static-Object-Token'] = 'foobar'
+            execute_raw_requests(requests: 1, project: project, file_path: file_path)
+
+            expect(response).to have_gitlab_http_status(302)
+            expect(response.location).to end_with('/users/sign_in')
+          end
+        end
+      end
+    end
   end
-  def execute_raw_requests(requests:, project:, file_path:)
+  def execute_raw_requests(requests:, project:, file_path:, **params)
     requests.times do
       get :show, params: {
         namespace_id: project.namespace,
         project_id: project,
         id: file_path
-      }
+      }.merge(params)
     end
   end
 end

spec/features/projects/blobs/blob_show_spec.rb

@@ -611,4 +611,50 @@ describe 'File blob', :js do
       expect(page).to have_selector '.gpg-status-box.invalid'
     end
   end
+
+  context 'when static objects external storage is enabled' do
+    before do
+      stub_application_setting(static_objects_external_storage_url: 'https://cdn.gitlab.com')
+    end
+
+    context 'private project' do
+      let_it_be(:project) { create(:project, :repository, :private) }
+      let_it_be(:user) { create(:user) }
+
+      before do
+        project.add_developer(user)
+
+        sign_in(user)
+        visit_blob('README.md')
+      end
+
+      it 'shows open raw and download buttons with external storage URL prepended and user token appended to their href' do
+        path = project_raw_path(project, 'master/README.md')
+        raw_uri = "https://cdn.gitlab.com#{path}?token=#{user.static_object_token}"
+        download_uri = "https://cdn.gitlab.com#{path}?inline=false&token=#{user.static_object_token}"
+
+        aggregate_failures do
+          expect(page).to have_link 'Open raw', href: raw_uri
+          expect(page).to have_link 'Download', href: download_uri
+        end
+      end
+    end
+
+    context 'public project' do
+      before do
+        visit_blob('README.md')
+      end
+
+      it 'shows open raw and download buttons with external storage URL prepended to their href' do
+        path = project_raw_path(project, 'master/README.md')
+        raw_uri = "https://cdn.gitlab.com#{path}"
+        download_uri = "https://cdn.gitlab.com#{path}?inline=false"
+
+        aggregate_failures do
+          expect(page).to have_link 'Open raw', href: raw_uri
+          expect(page).to have_link 'Download', href: download_uri
+        end
+      end
+    end
+  end
 end

spec/finders/pipelines_finder_spec.rb

@@ -170,41 +170,14 @@ describe PipelinesFinder do
       end
     end
-    context 'when order_by and sort are specified' do
-      context 'when order_by user_id' do
-        let(:params)     { { order_by: 'user_id', sort: 'asc' } }
-        let(:users)      { Array.new(2) { create(:user, developer_projects: [project]) } }
-        let!(:pipelines) { users.map { |user| create(:ci_pipeline, project: project, user: user) } }
-
-        it 'sorts as user_id: :asc' do
-          is_expected.to match_array(pipelines)
-        end
-
-        context 'when sort is invalid' do
-          let(:params) { { order_by: 'user_id', sort: 'invalid_sort' } }
-
-          it 'sorts as user_id: :desc' do
-            is_expected.to eq(pipelines.sort_by { |p| -p.user.id })
-          end
-        end
-      end
-
-      context 'when order_by is invalid' do
-        let(:params) { { order_by: 'invalid_column', sort: 'asc' } }
-        let!(:pipelines) { create_list(:ci_pipeline, 2, project: project) }
-
-        it 'sorts as id: :asc' do
-          is_expected.to eq(pipelines.sort_by { |p| p.id })
-        end
-      end
-
-      context 'when both are nil' do
-        let(:params) { { order_by: nil, sort: nil } }
-        let!(:pipelines) { create_list(:ci_pipeline, 2, project: project) }
-
-        it 'sorts as id: :desc' do
-          is_expected.to eq(pipelines.sort_by { |p| -p.id })
-        end
+    context 'when updated_at filters are specified' do
+      let(:params) { { updated_before: 1.day.ago, updated_after: 3.days.ago } }
+      let!(:pipeline1) { create(:ci_pipeline, project: project, updated_at: 2.days.ago) }
+      let!(:pipeline2) { create(:ci_pipeline, project: project, updated_at: 4.days.ago) }
+      let!(:pipeline3) { create(:ci_pipeline, project: project, updated_at: 1.hour.ago) }
+
+      it 'returns deployments with matched updated_at' do
+        is_expected.to match_array([pipeline1])
       end
     end
@@ -249,5 +222,36 @@ describe PipelinesFinder do
         end
       end
     end
+
+    describe 'ordering' do
+      using RSpec::Parameterized::TableSyntax
+
+      let(:params) { { order_by: order_by, sort: sort } }
+
+      let!(:pipeline_1) { create(:ci_pipeline, :scheduled, project: project, iid: 11, ref: 'master', created_at: Time.now, updated_at: Time.now, user: create(:user)) }
+      let!(:pipeline_2) { create(:ci_pipeline, :created, project: project, iid: 12, ref: 'feature', created_at: 1.day.ago, updated_at: 2.hours.ago, user: create(:user)) }
+      let!(:pipeline_3) { create(:ci_pipeline, :success, project: project, iid: 8, ref: 'patch', created_at: 2.days.ago, updated_at: 1.hour.ago, user: create(:user)) }
+
+      where(:order_by, :sort, :ordered_pipelines) do
+        'id'         | 'asc'  | [:pipeline_1, :pipeline_2, :pipeline_3]
+        'id'         | 'desc' | [:pipeline_3, :pipeline_2, :pipeline_1]
+        'ref'        | 'asc'  | [:pipeline_2, :pipeline_1, :pipeline_3]
+        'ref'        | 'desc' | [:pipeline_3, :pipeline_1, :pipeline_2]
+        'status'     | 'asc'  | [:pipeline_2, :pipeline_1, :pipeline_3]
+        'status'     | 'desc' | [:pipeline_3, :pipeline_1, :pipeline_2]
+        'updated_at' | 'asc'  | [:pipeline_2, :pipeline_3, :pipeline_1]
+        'updated_at' | 'desc' | [:pipeline_1, :pipeline_3, :pipeline_2]
+        'user_id'    | 'asc'  | [:pipeline_1, :pipeline_2, :pipeline_3]
+        'user_id'    | 'desc' | [:pipeline_3, :pipeline_2, :pipeline_1]
+        'invalid'    | 'asc'  | [:pipeline_1, :pipeline_2, :pipeline_3]
+        'id'         | 'err'  | [:pipeline_3, :pipeline_2, :pipeline_1]
+      end
+
+      with_them do
+        it 'returns the pipelines ordered' do
+          expect(subject).to eq(ordered_pipelines.map { |name| public_send(name) })
+        end
+      end
+    end
   end
 end

spec/frontend/error_tracking_settings/components/error_tracking_form_spec.js

@@ -49,7 +49,9 @@ describe('error tracking settings form', () => {
     it('is rendered with labels and placeholders', () => {
       const pageText = wrapper.text();
-      expect(pageText).toContain('Find your hostname in your Sentry account settings page');
+      expect(pageText).toContain(
+        "If you self-host Sentry, enter the full URL of your Sentry instance. If you're using Sentry's hosted solution, enter https://sentry.io",
+      );
       expect(pageText).toContain(
         "After adding your Auth Token, use the 'Connect' button to load projects",
       );