This reduces the queries from 97137 to 65136 and the query time from
02:04 to 01:27 in spec/requests/api/merge_requests.rb.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Previously, this would include the entire User record in the update
hash, which was rendered in the response using `to_json`, erroneously
exposing every attribute of that record, including their (now removed)
private token.
Now we only include the user ID, and perform the lookup on-demand.
1. Get the spec for `lib/gitlab/auth.rb` passing.
- Make the `request` argument to `AccessTokenValidationService` optional -
`auth.rb` doesn't need to pass in a request.
- Pass in scopes in the format `[{ name: 'api' }]` rather than `['api']`, which
is what `AccessTokenValidationService` now expects.
2. Get the spec for `API::V3::Users` passing
2. Get the spec for `AccessTokenValidationService` passing
- Test `GET` endpoints to check that the scope is allowed.
- Test `POST` endpoints to check that the scope is disallowed.
- Test both `v3` and `v4` endpoints.
Delegate a discussion in a merge request into a new issue.
The discussion wil be marked as resolved and a system note will be
added linking to the newly created issue.
- Use issue/merge_request IID instead of ID
- Duplicate the original `TimeTrackingEndpoints` concern (+ specs) for V3, since
this is a breaking change.
- As opposed to the issue `id` that was previously being used.
- This brings the API routes closer to the web interface's routes.
- This is specific to API v4.
New endpoints are:
POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/time_estimate"
POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/reset_time_estimate"
POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/add_spent_time"
POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/reset_spent_time"
GET :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/time_stats"
Also, mutualize AccessRequests and Members endpoints for Group &
Project.
New API documentation for the AccessRequests endpoints.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fabio Busatto
Robert Speicher
Rémy Coutable
Stan Hu
Robert Schilling
Jasper Maes
Sean McGivern
sliaquat
Felipe Artur
Lin Jen-Shin
Francisco Javier López
Mark Fletcher
Jacopo
blackst0ne
Douwe Maan
Robin Bobbitt
Timothy Andrew
Pawel Chojnacki
Bob Van Landuyt
Robert Schilling
Ruben Davila
Douglas Barbosa Alexandre