Allow multipart uploads for packages

Only when:
* Object storage is disabled
OR
* Object storage is enabled but direct upload is disabled.

ee/changelogs/unreleased/208744-fix-nuget-uploads-without-object-storage.yml

+---
+title: Allow multipart uploads for packages
+merge_request: 26387
+author:
+type: fixed

ee/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb

@@ -164,6 +164,10 @@ RSpec.shared_examples 'process nuget upload' do |user_type, status, add_member =
     end
 
     context 'with object storage disabled' do
+      before do
+        allow(Gitlab.config.packages.object_store).to receive(:enabled).and_return(false)
+      end
+
       context 'without a file from workhorse' do
         let(:params) { { package: nil } }
 
@@ -178,10 +182,6 @@ RSpec.shared_examples 'process nuget upload' do |user_type, status, add_member =
     end
 
     context 'with object storage enabled' do
-      context 'and direct upload enabled' do
-        let!(:fog_connection) do
-          stub_package_file_object_storage(direct_upload: true)
-        end
       let(:tmp_object) do
         fog_connection.directories.new(key: 'packages').files.create(
           key: "tmp/uploads/#{file_name}",
@@ -191,6 +191,11 @@ RSpec.shared_examples 'process nuget upload' do |user_type, status, add_member =
       let(:fog_file) { fog_to_uploaded_file(tmp_object) }
       let(:params) { { package: fog_file, 'package.remote_id' => file_name } }
 
+      context 'and direct upload enabled' do
+        let(:fog_connection) do
+          stub_package_file_object_storage(direct_upload: true)
+        end
+
         it_behaves_like 'creates nuget package files'
 
         ['123123', '../../123123'].each do |remote_id|
@@ -207,8 +212,26 @@ RSpec.shared_examples 'process nuget upload' do |user_type, status, add_member =
         end
       end
 
-      it_behaves_like 'background upload schedules a file migration'
+      context 'and direct upload disabled' do
+        context 'and background upload disabled' do
+          let(:fog_connection) do
+            stub_package_file_object_storage(direct_upload: false, background_upload: false)
           end
+
+          it_behaves_like 'creates nuget package files'
+        end
+
+        context 'and background upload enabled' do
+          let(:fog_connection) do
+            stub_package_file_object_storage(direct_upload: false, background_upload: true)
+          end
+
+          it_behaves_like 'creates nuget package files'
+        end
+      end
+    end
+
+    it_behaves_like 'background upload schedules a file migration'
   end
 end
 

lib/gitlab/middleware/multipart.rb

@@ -90,6 +90,11 @@ module Gitlab
             File.join(Rails.root, 'public/uploads/tmp')
           ]
 
+          packages_config = Gitlab.config.packages
+          if allow_packages_storage_path?(packages_config)
+            allowed_paths << File.join(packages_config.storage_path, 'tmp/uploads')
+          end
+
           ::UploadedFile.from_params(params, key, allowed_paths)
         end
 
@@ -106,6 +111,15 @@ module Gitlab
           # inside other env keys, here we ensure everything is updated correctly
           ActionDispatch::Request.new(@request.env).update_param(key, value)
         end
+
+        private
+
+        def allow_packages_storage_path?(config)
+          return unless config.enabled
+          return unless config['storage_path']
+
+          !config.object_store.enabled || !config.object_store.direct_upload
+        end
       end
 
       def initialize(app)

spec/lib/gitlab/middleware/multipart_spec.rb

@@ -101,6 +101,86 @@ describe Gitlab::Middleware::Multipart do
     end
   end
 
+  context 'with packages storage' do
+    let(:storage_path) { 'shared/packages' }
+
+    RSpec.shared_examples 'allowing the upload' do
+      it 'allows files to be uploaded' do
+        Dir.mktmpdir do |dir|
+          packages_upload_dir = File.join(dir, storage_path, 'tmp/uploads')
+          FileUtils.mkdir_p(packages_upload_dir)
+
+          Tempfile.open('top-level', packages_upload_dir) do |tempfile|
+            env = post_env({ 'file' => tempfile.path }, { 'file.name' => original_filename, 'file.path' => tempfile.path }, Gitlab::Workhorse.secret, 'gitlab-workhorse')
+
+            expect(app).to receive(:call) do |env|
+              expect(get_params(env)['file']).to be_a(::UploadedFile)
+            end
+
+            middleware.call(env)
+          end
+        end
+      end
+    end
+
+    context 'with object storage disabled' do
+      before do
+        stub_config(packages: {
+          enabled: true,
+          object_store: {
+            enabled: false
+          },
+          storage_path: storage_path
+        })
+      end
+
+      it_behaves_like 'allowing the upload' do
+        before do
+          expect(Gitlab.config.packages).to receive(:storage_path).and_return(storage_path)
+        end
+      end
+    end
+
+    context 'with object storage enabled' do
+      context 'with direct upload enabled' do
+        before do
+          stub_config(packages: {
+            enabled: true,
+            object_store: {
+              enabled: true,
+              direct_upload: true
+            }
+          })
+        end
+
+        it_behaves_like 'allowing the upload' do
+          before do
+            expect(Gitlab.config.packages).not_to receive(:storage_path)
+          end
+        end
+      end
+
+      context 'with direct upload disabled' do
+        before do
+          stub_config(packages: {
+            enabled: true,
+            object_store: {
+              enabled: true,
+              direct_upload: false
+            },
+            storage_path: storage_path
+          })
+        end
+
+        it_behaves_like 'allowing the upload' do
+          before do
+            expect(Gitlab.config.packages).to receive(:storage_path).and_return(storage_path)
+          end
+        end
+      end
+    end
+  end
+
   it 'allows symlinks for uploads dir' do
     Tempfile.open('two-levels') do |tempfile|
       symlinked_dir = '/some/dir/uploads'