Merge branch 'issue_350670-deprecate_notes_confidential_attribute_on_apis' into 'master'

Deprecate modifying notes confidentiality on APIs

See merge request gitlab-org/gitlab!83542

app/graphql/mutations/notes/update/note.rb

@@ -15,7 +15,8 @@ module Mutations
         argument :confidential,
                  GraphQL::Types::Boolean,
                  required: false,
-                 description: 'Confidentiality flag of a note. Default is false.'
+                 description: 'Confidentiality flag of a note. Default is false.',
+                 deprecated: { reason: 'No longer allowed to update confidentiality of notes', milestone: '14.10' }
 
         private
 

data/deprecations/14-10-deprecate-toggle-notes-confidentiality.yml

+- name: "Toggle notes confidentiality on APIs"
+  announcement_milestone: "14.10"  # The milestone when this feature was first announced as deprecated.
+  announcement_date: "2022-03-22"  # The date of the milestone release when this feature was first announced as deprecated. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
+  removal_milestone: "16.0"  # The milestone when this feature is planned to be removed
+  removal_date: "2023-05-22"  # The date of the milestone release when this feature is planned to be removed. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
+  breaking_change: true  # If this deprecation is a breaking change, set this value to true
+  body: |  # Do not modify this line, instead modify the lines below.
+    Toggling notes confidentiality with REST and GraphQL APIs is being deprecated. Updating notes confidential attribute is no longer supported by any means. We are changing this to simplify the experience and prevent private information from being unintentionally exposed.
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/350670

doc/api/graphql/reference/index.md

@@ -5014,7 +5014,7 @@ Input type: `UpdateNoteInput`
 | ---- | ---- | ----------- |
 | <a id="mutationupdatenotebody"></a>`body` | [`String`](#string) | Content of the note. |
 | <a id="mutationupdatenoteclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
-| <a id="mutationupdatenoteconfidential"></a>`confidential` | [`Boolean`](#boolean) | Confidentiality flag of a note. Default is false. |
+| <a id="mutationupdatenoteconfidential"></a>`confidential` **{warning-solid}** | [`Boolean`](#boolean) | **Deprecated:** No longer allowed to update confidentiality of notes. Deprecated in 14.10. |
 | <a id="mutationupdatenoteid"></a>`id` | [`NoteID!`](#noteid) | Global ID of the note to update. |
 
 #### Fields

doc/api/notes.md

@@ -163,12 +163,12 @@ PUT /projects/:id/issues/:issue_iid/notes/:note_id
 Parameters:
 
 | Attribute      | Type           | Required    | Description                                                                                        |
-|----------------|----------------|----------|----------------------------------------------------------------------------------|
+|----------------|----------------|-------------|----------------------------------------------------------------------------------------------------|
 | `id`           | integer or string | yes      | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding).                    |
 | `issue_iid`    | integer           | yes      | The IID of an issue.                                                                               |
 | `note_id`      | integer           | yes      | The ID of a note.                                                                                  |
 | `body`         | string            | no       | The content of a note. Limited to 1,000,000 characters.                                            |
-| `confidential` | boolean        | no       | The confidential flag of a note.                                                 |
+| `confidential` | boolean           | no       | **Deprecated:** will be removed in GitLab 16.0. The confidential flag of a note. Default is false. |
 
 ```shell
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/5/issues/11/notes?body=note"
@@ -416,11 +416,12 @@ PUT /projects/:id/merge_requests/:merge_request_iid/notes/:note_id
 Parameters:
 
 | Attribute           | Type              | Required | Description                                                                                        |
-|---------------------|----------------|----------|---------------------------------------------------------------------------------|
+|---------------------|-------------------|----------|----------------------------------------------------------------------------------------------------|
 | `id`                | integer or string | yes      | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding)                     |
 | `merge_request_iid` | integer           | yes      | The IID of a project merge request                                                                 |
 | `note_id`           | integer           | no       | The ID of a note                                                                                   |
 | `body`              | string            | yes      | The content of a note. Limited to 1,000,000 characters.                                            |
+| `confidential`      | boolean           | no       | **Deprecated:** will be removed in GitLab 16.0. The confidential flag of a note. Default is false. |
 
 ```shell
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/5/merge_requests/11/notes?body=note"
@@ -541,11 +542,12 @@ PUT /groups/:id/epics/:epic_id/notes/:note_id
 Parameters:
 
 | Attribute      | Type              | Required | Description                                                                                        |
-| --------- | -------------- | -------- | ----------- |
+| ---------------| ----------------- | -------- | ---------------------------------------------------------------------------------------------------|
 | `id`           | integer or string | yes      | The ID or [URL-encoded path of the group](index.md#namespaced-path-encoding)                       |
 | `epic_id`      | integer           | yes      | The ID of an epic                                                                                  |
 | `note_id`      | integer           | yes      | The ID of a note                                                                                   |
 | `body`         | string            | yes      | The content of a note. Limited to 1,000,000 characters.                                            |
+| `confidential` | boolean           | no       | **Deprecated:** will be removed in GitLab 16.0. The confidential flag of a note. Default is false. |
 
 ```shell
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/groups/5/epics/11/notes?body=note"

doc/update/deprecations.md

@@ -74,6 +74,18 @@ For more information about iteration cadences, you can refer to
 
 **Planned removal milestone: 16.0 (2023-04-22)**
 
+### Toggle notes confidentiality on APIs
+
+WARNING:
+This feature will be changed or removed in 16.0
+as a [breaking change](https://docs.gitlab.com/ee/development/contributing/#breaking-changes).
+Before updating GitLab, review the details carefully to determine if you need to make any
+changes to your code, settings, or workflow.
+
+Toggling notes confidentiality with REST and GraphQL APIs is being deprecated. Updating notes confidential attribute is no longer supported by any means. We are changing this to simplify the experience and prevent private information from being unintentionally exposed.
+
+**Planned removal milestone: 16.0 (2023-05-22)**
+
 ## 14.9
 
 ### Background upload for object storage

lib/api/notes.rb

@@ -112,7 +112,7 @@ module API
           requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
           requires :note_id, type: Integer, desc: 'The ID of a note'
           optional :body, type: String, allow_blank: false, desc: 'The content of a note'
-          optional :confidential, type: Boolean, desc: 'Confidentiality note flag'
+          optional :confidential, type: Boolean, desc: '[Deprecated in 14.10] No longer allowed to update confidentiality of notes'
         end
         put ":id/#{noteables_str}/:noteable_id/notes/:note_id", feature_category: feature_category do
           noteable = find_noteable(noteable_type, params[:noteable_id])