Geo: Return replication lag for secondary

Only display if we're fetching / pulling, DB is
read-only and lag > 0.

ee/changelogs/unreleased/9217-warn-on-git-fetch-over-ssh-if-the-secondary-is-lagging-the-primary.yml

+---
+title: 'Geo: Display secondary replication lag on console (if lag > 0 seconds)'
+merge_request: 10471
+author:
+type: added

ee/lib/ee/gitlab/geo_git_access.rb

@@ -18,6 +18,13 @@ module EE
         super
       end
 
+      override :check_for_console_messages
+      def check_for_console_messages(cmd)
+        super.push(
+          *current_replication_lag_message(cmd)
+        )
+      end
+
       protected
 
       def project_or_wiki
@@ -26,8 +33,20 @@ module EE
 
       private
 
+      def current_replication_lag_message(cmd)
+        return unless upload_pack?(cmd) # git fetch / pull
+        return unless ::Gitlab::Database.read_only?
+        return unless current_replication_lag > 0
+
+        "Current replication lag: #{current_replication_lag} seconds"
+      end
+
+      def current_replication_lag
+        @current_replication_lag ||= ::Gitlab::Geo::HealthCheck.new.db_replication_lag_seconds
+      end
+
       def custom_action_for?(cmd)
-        return unless receive_pack?(cmd)
+        return unless receive_pack?(cmd) # git push
         return unless ::Gitlab::Database.read_only?
 
         ::Gitlab::Geo.secondary_with_primary?

ee/spec/lib/gitlab/git_access_spec.rb

 require 'spec_helper'
 
 describe Gitlab::GitAccess do
+  include EE::GeoHelpers
+
   set(:user) { create(:user) }
 
   let(:actor) { user }
@@ -249,11 +251,43 @@ describe Gitlab::GitAccess do
     end
   end
 
-  describe 'Geo system permissions' do
+  describe 'Geo' do
     let(:actor) { :geo }
 
-    it { expect { pull_changes }.not_to raise_error }
-    it { expect { push_changes }.to raise_unauthorized(Gitlab::GitAccess::ERROR_MESSAGES[:upload]) }
+    context 'git pull' do
+      it { expect { pull_changes }.not_to raise_error }
+
+      context 'for a secondary' do
+        let(:current_replication_lag) { nil }
+
+        before do
+          stub_licensed_features(geo: true)
+          stub_current_geo_node(create(:geo_node))
+
+          allow_any_instance_of(Gitlab::Geo::HealthCheck).to receive(:db_replication_lag_seconds).and_return(current_replication_lag)
+        end
+
+        context 'that has no DB replication lag' do
+          let(:current_replication_lag) { 0 }
+
+          it 'does not return a replication lag message in the console messages' do
+            expect(pull_changes.console_messages).to be_empty
+          end
+        end
+
+        context 'that has DB replication lag > 0' do
+          let(:current_replication_lag) { 7 }
+
+          it 'returns a replication lag message in the console messages' do
+            expect(pull_changes.console_messages).to eq(['Current replication lag: 7 seconds'])
+          end
+        end
+      end
+    end
+
+    context 'git push' do
+      it { expect { push_changes }.to raise_unauthorized(Gitlab::GitAccess::ERROR_MESSAGES[:upload]) }
+    end
   end
 
   private