User with developer role gets 403 when updating pull mirror

Summary

Users with the role of Developer are unable to force an update of a pull mirror. Our documentation states that any user with a role of Developer or higher should be able to.

Steps to reproduce

1. Set up a pull mirrored repository.
2. Add a user to the project with a role of Developer
3. Have the user update the mirror with curl --request POST --header "PRIVATE-TOKEN: xxxxxxxxxx" "https://gitlab.example.com/api/v4/projects/<id>/mirror/pull"
4. Navigate Repository -> Branches, notice that the Update now button is greyed out

What is the current bug behavior?

Users with a Developer role cannot force an update to a pull mirror. This contradicts the documentation.

What is the expected correct behavior?

Users with a Developer role can force an update to a pull mirror.

Relevant logs and/or screenshots

{"message":"403 Forbidden"}%

Observed on 12.10.14-ee and reproduced on 13.2.2-ee

Links

Docs: https://docs.gitlab.com/ee/user/project/repository/repository_mirroring.html#overview Customer ticket: https://gitlab.zendesk.com/agent/tickets/169206

added customer devopscreate groupsource code mirroring severity2 typebug labels

changed title from User with developer role gets 403 when updating pull mirror via the API to User with developer role gets 403 when updating pull mirror

changed the description

It was pointed out that Developers are also not able to update the mirror via the UI. I adjusted the title and description to reflect that.

mentioned in issue #240842 (closed)

added priority3 severity3 labels and removed severity2 label

mentioned in issue #243455 (closed)

changed milestone to %Backlog

added [deprecated] Accepting merge requests label

added sectiondev label

added vintage label

• ZD Ticket: https://gitlab.zendesk.com/agent/tickets/284018

It looks like our documentation was updated:

You must have at least the Maintainer role for the project.

• API docs are not explicit on what are required:

• Permissions docs do mention that CI/CD Settings are maintainer only.

I think the 403 makes sense here, but maybe this issue could be reworked into giving Developers the ability to update mirrors without needing to access the settings.

added to epic &8225

added Category:Source Code Management label

mentioned in issue create-stage#13124 (closed)

I think the 403 makes sense here

Closing as working as designed. If this API is requested to be used by the Developer role, a feature request should be opened.

closed