Introduce not filters for code review analytics

Adds support of negative filters for labels
and milestone

ee/changelogs/unreleased/206955-not-filters-for-code-review-analytics.yml

+---
+title: Introduce negative filters for code review analytics
+merge_request: 30506
+author:
+type: added

ee/lib/api/analytics/code_review_analytics.rb

@@ -21,21 +21,25 @@ module API
               attempt_project_search_optimizations: true
             }
 
-            finder_options = params.slice(*MergeRequestsFinder.valid_params).merge(finder_options)
-
-            MergeRequestsFinder.new(current_user, finder_options)
+            MergeRequestsFinder.new(current_user, declared_params.merge(finder_options))
+          end
         end
+
+        params :negatable_params do
+          optional :label_name, type: Array, desc: 'Array of label names to filter by'
+          optional :milestone_title, type: String, desc: 'Milestone title to filter by'
         end
       end
 
       resource :analytics do
-        desc 'List code review information about project' do
-        end
+        desc 'List code review information about project'
         params do
           requires :project_id, type: Integer, desc: 'Project ID'
-          optional :label_name, type: Array, desc: 'Array of label names to filter by'
-          optional :milestone_title, type: String, desc: 'Milestone title to filter by'
+          use :negatable_params
           use :pagination
+          optional :not, type: Hash do
+            use :negatable_params
+          end
         end
         get 'code_review' do
           authorize! :read_code_review_analytics, project

ee/spec/requests/api/analytics/code_review_analytics_spec.rb

@@ -54,6 +54,16 @@ describe API::Analytics::CodeReviewAnalytics do
           expect(json_response.map { |mr| mr['id']}).to match_array([merge_request_3.id])
         end
       end
+
+      context 'with negation filters' do
+        let(:query_params) { super().merge(not: { label_name: [label.title] }) }
+
+        it 'applies filter' do
+          api_call
+
+          expect(json_response.map { |mr| mr['id'] }).to match_array([merge_request_1.id])
+        end
+      end
     end
 
     context 'when user has no authorization' do